Splunk® App for VMware (Legacy)

User Guide

On August 31, 2022, the Splunk App for VMware will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for VMware Dashboards and Reports.

Navigation and operation

Navigating the topology map

The topology map is used to represent your VMware vSphere environment. You can access it on the Proactive Monitoring dashboard.

You can navigate your topology map in two dimensions. This provides an alternate view to the data displayed.

  • To pan within the view, click and drag the map.
  • To zoom in or out, click + or - on the legend.

You can get additional information about your environment:

  • Hover on a node to display the tooltip for that node.
  • Click on a node to display or hide the child entities of that node.
  • Parent nodes have node status indicators (a doughnut chart wrapped around the node).
  • A node that is red is in a critical state for the metric selected.
  • A node with a ring around it provides a visual view of the state of the environment under that node.

See Proactive Monitoring for more information.

Making selections

You can filter the data displayed on many of the dashboards using drop-down list, autocomplete textboxes, or a menu tree.

Drop-down lists

Select an item from the list to filter your search selection. In many of the dashboards search selection filtering is done using a combination of drop-down lists and one other search method.

Autocomplete textbox

Use the autocomplete search feature to search your VMware vSphere hierarchy of entities. Navigating very large environment is fast and easy. You can perform two different types of search:

  • Entity level search.
  • Full path search.

You can search using the name or a partial name of an asset. As you type, the textbox automatically generates a drop-down list of predicted searches based on your search criteria. Predictive search allows you to search on a single entity at a time. Search predictions are based on all of the search characters entered in the text box.

If your search term does not display any results, then the specific asset is not in your environment. Try generalizing your search.


  • Search for a host, for exampe esxi-01:
    • Select the host button to predetermine the search type.
    • Enter any part of the asset name, such as "01", to get a list of all possible matches. The full hierarchy for the entity is displayed in the drop-down list and the hosts that match the search criteria are displayed and highlighted in a list to the right of the hierarchy.
  • Search for a virtual machine, for example vmw-65-01:
    • Select the VM button to predetermine the search type.
    • Enter the search criteria, such as "vmw", and a drop-down list is populates with all possible matches. The full hierarchy for the entity is displayed in the drop-down list and the virtual machines are displayed and highlighted in a list to the right of the hierarchy.
  • Enter an invalid option and the the text box turns red to indicate an invalid entry.
  • Use the up arrow on your keyboard to move up a selection in the list.
  • Use the down arrow on your keyboard to move down the selection in the list.

Menu tree

Use the menu tree to search across multiple entities at a time. It supports the multi-select feature.

Color usage

The level of criticality in your environment is highlighted in the app using a basic color set. The following colors are used as indicators:

  • Red indicates a critical state.
  • Orange indicates a warning state.
  • Green indicates normal operation for your environment.
  • Grey indicates that the data is unavailable or that the entity is not powered on.
Last modified on 13 April, 2022
Dashboards overview   Home

This documentation applies to the following versions of Splunk® App for VMware (Legacy): 4.0.4

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters