Use data models
Splunk App for VMware uses data models to improve the efficiency of searches within the app. If you are upgrading the app from version 3.1.4 to 3.2.0, learn how to map tsidx namespaces to nodes in the data models. See Upgrade to Splunk App for VMware 3.2.0 in the "Installation Guide".
Fields for VMWareInventory event objects
The following table lists the extracted and calculated fields for the event objects in the VMWareInventory data model.
Object name | Field name | Data type |
---|---|---|
Inventory | moid
|
string |
Inventory | type
|
string |
Inventory | _time
|
timestamp |
Inventory | host
|
string |
Inventory | source
|
string |
Inventory | sourcetype
|
string |
Inventory | filename
|
string |
Inventory | filesize
|
number |
Inventory | filetype
|
string |
Inventory | Snapshots
|
string |
Fields for VMWarePerformrance event objects
The following table lists the extracted and calculated fields for the event objects in the VMWarePerformance data model.
Object name | Field name | Data type |
---|---|---|
vmperformance | moid
|
string |
vmperformance | instance
|
string |
vmperformance | _time
|
timestamp |
vmperformance | host
|
string |
vmperformance | source
|
string |
vmperformance | sourcetype
|
string |
vmperformance | hs
|
string |
vmperformance | rp
|
string |
vmperformance | parent
|
string |
vmperformance | parentType
|
string |
vmperformance | ccr
|
string |
cpu | p_average_cpu_coreUtilization_percent
|
number |
cpu | p_average_cpu_demand_megaHertz
|
number |
cpu | p_average_cpu_latency_percent
|
number |
cpu | p_average_cpu_reservedCapacity_megaHertz
|
number |
cpu | p_average_cpu_totalCapaticy_megaHertz
|
number |
cpu | p_average_cpu_usage_percent
|
number |
cpu | p_average_cpu_usagemhz_megaHertz
|
number |
cpu | p_average_cpu_utilization_percent
|
number |
cpu | p_latest_cpu_entitlement_megaHertz
|
number |
cpu | p_summation_cpu_costop_millisecond
|
number |
cpu | p_summation_cpu_idle_millisecond
|
number |
cpu | p_summation_cpu_maxlimited_millisecond
|
number |
cpu | p_summation_cpu_overlap_millisecond
|
number |
cpu | p_summation_cpu_ready_millisecond
|
number |
cpu | p_summation_cpu_run_millisecond
|
number |
cpu | p_summation_cpu_swapwait_millisecond
|
number |
cpu | p_summation_cpu_system_millisecond
|
number |
cpu | p_summation_cpu_used_millisecond
|
number |
cpu | p_summation_cpu_wait_millisecond
|
number |
Add, edit, or delete a VMware vCenter Server | Deploy Splunk App for VMware in an indexer cluster deployment |
This documentation applies to the following versions of Splunk® App for VMware (Legacy): 3.4.1, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.7
Feedback submitted, thanks!