topic Re: VMWare APP Usage in All Apps and Add-ons

VMWare APP Usage

matthewparry — Mon, 28 Sep 2020 12:21:04 GMT

Hi,

Is it possible to get a daily indexed total per ESX(Host) and VC rather than an indexed daily total for the entire vmware index?
The APP uses multiple indexes also, so it would need to take into consideration these?

Maybe something like:

index=_internal source=*license_usage.log type=Usage | eval MB=b/1024/1024 | timechart span=1d sum(MB) by h useother=false

Re: VMWare APP Usage

tuxford — Thu, 30 Aug 2012 13:01:01 GMT

If you go Status - Index activity - Indexing volume you can split by index, source, sourcetype and host.

Re: VMWare APP Usage

tuxford — Mon, 03 Sep 2012 12:32:05 GMT

Maybe this one can be tweaked to your needs?

index="_internal" source="*metrics.log" per_host_thruput series="*esxi*" OR series="*vc*" | eval MB=kb/1024 | chart sum(MB) by series

Re: VMWare APP Usage

ayme — Mon, 03 Sep 2012 12:43:37 GMT

I believe Tuxford's search is not 100% reliable because Splunk only logs the top few volume-generating hosts in the internal log.

Calculating the raw bytes of a message is often a good indicator:

index=vmware host=esxi* | eval bytes=len(_raw) | stats sum(bytes) as bytes by host | eval bytes/1024/1024

Although I believe meta data also counts towards indexing volume so the above search isn't 100% either (but likely to be close enough)