Splunk® App for VMware (Legacy)

Installation and Configuration Guide

On August 31, 2022, the Splunk App for VMware will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for VMware Dashboards and Reports.
This documentation does not apply to the most recent version of Splunk® App for VMware (Legacy). For documentation on the most recent version, go to the latest release.

Considerations when using tsidx namespaces

Using TSIDX namespaces

The Splunk App for VMware uses TSIDX stats to offer better search acceleration than is possible using either summary indexing or report acceleration. TSIDX is similar to summary indexing, in that it allows for dramatically improved performance. When using TSIDX stats the Splunk App for VMware creates a number of TSIDX namespaces that are used to store the summary statistical data used by the dashboards in the app. Summary data for the Splunk App for VMware 3.x is stored on the search head, except in a search head pooled environment where it is stored in shared storage that can be accessed by all search heads. The default size for a tsidx namespace file is 500000 MB (488.28 GB).

Defined namespaces

In the Splunk App for VMware all performance data is stored in TSIDX namespaces. You can see a list of all of the namespaces used by the app in the $SPLUNK_HOME/etc/apps/SA-VMW-Performance/default/savedsearches.conf file. This information is used to populate dashboards with performance data throughout the app. If the tsidx_namespaces are created correctly, then performance data populates the index and you can see a list of all of the tsidx_namespaces that are used in the app in the App Install Health dashboard in the VMware Performance Data TSIDX Namespaces panel. Click on a tsidx_namespace to drill down to the search that populates it.

Setting a retention policy

You can manage the size of the namespace files using a retention policy. The default retention time period is 2,184 days. The retention policy is specified in the tsidx_retention.conf file, where a limit can be put on the size of the TSIDX namespaces and a limit can be applied to the length of time that namespaces are retained.

The $SPLUNK_HOME/etc/apps/SA-Utils/default/tsidx_retention.conf file is used to set up a default policy for all namespaces. If specific retention policies are not set up for individual namespaces, then the app uses the default value specified in SA-utils, for all namespaces that do not have one specifically defined. To apply the recommended settings, create a local/tsidx_retention.conf file and configure the settings there to set a policy for all namespaces.

To set up a retention policy for specific namespaces in the app, edit the local/tsidx_retention.conf file in each of the add-ons where you want to modify the TSIDX namespace retention time. The namespaces in your deployment is "cleaned up" (purged) when the file size or the time requirements are met. For example, create a $SPLUNK_HOME/etc/apps/SA-VMW-Performance/local/tsidx_retention.conf and uncomment the namespaces that you want to use in the app and the values associated with those namespaces to set up a retention policy for specific namespaces in the app. You can use the default values for the namespaces or modify the settings to values that work in your environment.

Namespaces used in the Splunk App for VMware

The Splunk App for VMware creates a number of TSIDX namespaces that are used to store the summary statistical data used by the dashboards in the app. The tables list the namespaces defined in the app and the attributes associated with each namespace. For each namespace, each table lists the location, the searches that populate the namespace (the generating search), the search used to identify the fields that store the data in the namespace, and the suggested retention period for the data.

vmw_perf_cpu_virtualmachine

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-cpu-virtualmachine
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields source=VMPerf:VirtualMachine sourcetype=vmware:perf:cpu | table * | fields - _*

vmw_perf_disk_virtualmachine

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-disk-virtualmachine
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields source=VMPerf:VirtualMachine sourcetype=vmware:perf:disk | table * | fields - _*

vmw_perf_datastore_virtualmachine

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-datastore-virtualmachine
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields source=VMPerf:VirtualMachine sourcetype=vmware:perf:datastore | table * | fields - _*

vmw_perf_mem_virtualmachine

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-mem-virtualmachine
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields source=VMPerf:VirtualMachine sourcetype=vmware:perf:mem | table * | fields - _*

vmw_perf_net_virtualmachine

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-net-virtualmachine
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields source=VMPerf:VirtualMachine sourcetype=vmware:perf:net | table * | fields - _*

vmw_perf_power_virtualmachine

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-power-virtualmachine
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields source=VMPerf:VirtualMachine sourcetype=vmware:perf:power | table * | fields - _*

vmw_perf_resdisk_virtualmachine

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-resdisk-virtualmachine
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields source=VMPerf:VirtualMachine sourcetype=vmware:perf:resdisk | table * | fields - _*

vmw_perf_rescpu_virtualmachine

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-rescpu-virtualmachine
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields source=VMPerf:VirtualMachine sourcetype=vmware:perf:rescpu | table * | fields - _*

vmw_perf_sys_virtualmachine

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-sys-virtualmachine
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields source=VMPerf:VirtualMachine sourcetype=vmware:perf:sys | table * | fields - _*

vmw_perf_cpu_hostsystem

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-cpu-hostsystem
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields source=VMPerf:HostSystem sourcetype=vmware:perf:cpu | table * | fields - _*

vmw_perf_disk_hostsystem

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-disk-hostsystem
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields source=VMPerf:HostSystem sourcetype=vmware:perf:disk | table * | fields - _*

vmw_perf_datastore_hostsystem

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-datastore-hostsystem
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields source=VMPerf:HostSystem sourcetype=vmware:perf:datastore | table * | fields - _*

vmw_perf_hbr_hostsystem

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-hbr-hostsystem
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields source=VMPerf:HostSystem sourcetype=vmware:perf:hbr | table * | fields - _*

vmw_perf_net_hostsystem

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-net-hostsystem
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields source=VMPerf:HostSystem sourcetype=vmware:perf:net | table * | fields - _*

vmw_perf_power_hostsystem

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-power-hostsystem
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields source=VMPerf:HostSystem sourcetype=vmware:perf:power | table * | fields - _*

vmw_perf_resstorageadapter_hostsystem

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-resstorageadapter-hostsystem
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields

vmw_perf_storageadapter_hostsystem

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-storageadapter-hostsystem
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields source=VMPerf:HostSystem sourcetype=vmware:perf:storageadapter | table * | fields - _*

vmw_perf_storagepath_hostsystem

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-storagepath-hostsystem
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields source=VMPerf:HostSystem sourcetype=vmware:perf:storagepath | table * | fields - _*

vmw_perf_sys_hostsystem

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-sys-hostsystem
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields source=VMPerf:HostSystem sourcetype=vmware:perf:sys | table * | fields - _*

vmw_perf_rescpu_hostsystem

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-rescpu-hostsystem
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields source=VMPerf:HostSystem sourcetype=vmware:perf:rescpu | table * | fields - _*

vmw_inv_datastore_virtualmachine

Details Description
Location SA-VMW-Performance
Generating search tsidx-inv-datastore-virtualmachine
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields source = VMInv:datastore sourcetype="vmware:inv:datastore" | table * | fields - _*

vmw_perf_cpu_resourcepool

This namespace is currently reserved but unused in the App.

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-cpu-resourcepool
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields Not available

vmw_perf_mem_resourcepool

This namespace is currently reserved but unused in the App.

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-mem-resourcepool
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields Not available

vmw_perf_cpu_clustercomputeresource

This namespace is currently reserved but unused in the App.

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-cpu-clustercomputeresource
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields Not available

vmw_perf_mem_clustercomputeresource

This namespace is currently reserved but unused in the App.

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-mem-clustercomputeresource
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields Not available

vmw_perf_vmop_clustercomputeresource

This namespace is currently reserved but unused in the App.

Details Description
Location SA-VMW-Performance
Generating search tsidx-perf-vmop-clustercomputeresource
Schedule runs every 5 minutes
Suggested retention period 2,184 days
Search to populate the fields Not available
Last modified on 02 April, 2014
Configure a cluster deployment   Configure Splunk for ESXi logs

This documentation applies to the following versions of Splunk® App for VMware (Legacy): 3.0, 3.0.1, 3.0.2, 3.1

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters