All Apps and Add-ons

Syntax for vm_instance_whitelist in vmware addon

jihape
Path Finder

The vmware add-on is creating too much data for us, so we wanted to limit the performance metrics to a subset of VMs (guests), but we can't seem to get the syntax right.

I've been adding vm_instance_whitelist = to ta_vmware_collection.conf under the vmware addon, but I haven't had any success yet.

First I tried with a regular expression like this (srv.+|db.+|web.+) but that didn't work, then I tried with srv.+,db.+,web.+ and didn't seem to work either.

If anyone knows how to do it please let me know.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi jihape,
to filter events see at http://docs.splunk.com/Documentation/Splunk/6.6.0/Forwarding/Routeandfilterdatad
in other words, to take only events with srv.+|db.+|web.+ you have to configure:
props.conf

[your_WMWare_Sourcetype]
TRANSFORMS-set= setnull,setparsing

transforms.conf

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = srv|db|web
DEST_KEY = queue
FORMAT = indexQueue

Restart Splunk Enterprise.

Bye.
Giuseppe

jihape
Path Finder

So in other words you can't really limit vmware performance data to specific hosts?

For example an event of sourcetype vmware:perf:power like this one would be send to the nullQueue because the event doesn't have the actual host name in it, only the uuid/vm_id.

vm-190316 501f3807-ad88-9616-f1b3-49edff4592c1 aggregated 20 111 5

0 Karma

gcusello
SplunkTrust
SplunkTrust

in the props.conf stanza header you can also use host

[host::your_host]

but I always prefer to use sourcetype.
Bye.
Giuseppe

0 Karma

jihape
Path Finder

I don't think this will work with the VMware performance data. The host of those events is the vCenter server you're collecting from, and the only reference to the VM is the uuid.

I guess it is not possible unfortunately.

The following lines should NOT be commented if you want to collect instance level data

host_instance_whitelist = .*
vm_instance_whitelist = .*

rp_instance_whitelist = .*

cluster_instance_whitelist = .*

Will probably have to collect data less frequently.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...