Splunk® App for VMware (Legacy)

Configuration Guide

On August 31, 2022, the Splunk App for VMware will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for VMware Dashboards and Reports.

Enable Data model acceleration and use data models

Splunk App for VMware uses data models to improve the efficiency of searches within the app. If you are upgrading the app from version 3.1.4 to 3.2.0, learn how to map tsidx namespaces to nodes in the data models. See Upgrade to Splunk App for VMware 3.2.0.

Enable data model acceleration

An admin can enable data acceleration or change the acceleration period. Complete the following steps on the search head to enable the acceleration of the "VMwareInventory" and "VMwarePerformance" data model:

Admin can enable acceleration or change the acceleration period by the following steps on the search head:

  1. In Splunk Web, go to Settings > Data Models.
  2. From the App list , select VMware (splunk_for_vmware) to see the data models defined and used by the Splunk App for VMware.
  3. Select "Edit" next to the data model you want to enable acceleration for.
  4. Select Edit Acceleration.
  5. Check Accelerate.
  6. Select the summary range to specify the acceleration period. The default summary range is 1 month.
  7. Click Save.

Fields for VMWareInventory event objects

The following table lists the extracted and calculated fields for the event objects in the VMWareInventory data model.

Object name Field name Data type
Inventory moid string
Inventory type string
Inventory _time timestamp
Inventory host string
Inventory source string
Inventory sourcetype string
Inventory filename string
Inventory filesize number
Inventory filetype string
Inventory Snapshots string

Fields for VMWarePerformrance event objects

The following table lists the extracted and calculated fields for the event objects in the VMWarePerformance data model.

Object name Field name Data type
vmperformance moid string
vmperformance instance string
vmperformance _time timestamp
vmperformance host string
vmperformance source string
vmperformance sourcetype string
vmperformance hs string
vmperformance rp string
vmperformance parent string
vmperformance parentType string
vmperformance ccr string
cpu p_average_cpu_coreUtilization_percent number
cpu p_average_cpu_demand_megaHertz number
cpu p_average_cpu_latency_percent number
cpu p_average_cpu_reservedCapacity_megaHertz number
cpu p_average_cpu_totalCapaticy_megaHertz number
cpu p_average_cpu_usage_percent number
cpu p_average_cpu_usagemhz_megaHertz number
cpu p_average_cpu_utilization_percent number
cpu p_latest_cpu_entitlement_megaHertz number
cpu p_summation_cpu_costop_millisecond number
cpu p_summation_cpu_idle_millisecond number
cpu p_summation_cpu_maxlimited_millisecond number
cpu p_summation_cpu_overlap_millisecond number
cpu p_summation_cpu_ready_millisecond number
cpu p_summation_cpu_run_millisecond number
cpu p_summation_cpu_swapwait_millisecond number
cpu p_summation_cpu_system_millisecond number
cpu p_summation_cpu_used_millisecond number
cpu p_summation_cpu_wait_millisecond number
Last modified on 13 April, 2022
Add, edit, or delete a VMware vCenter Server   Deploy Splunk App for VMware in an indexer cluster deployment

This documentation applies to the following versions of Splunk® App for VMware (Legacy): 4.0.4

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters