The vmware add-on is creating too much data for us, so we wanted to limit the performance metrics to a subset of VMs (guests), but we can't seem to get the syntax right.
I've been adding
vm_instance_whitelist = to
ta_vmware_collection.conf under the vmware addon, but I haven't had any success yet.
First I tried with a regular expression like this
(srv.+|db.+|web.+) but that didn't work, then I tried with
srv.+,db.+,web.+ and didn't seem to work either.
If anyone knows how to do it please let me know.
to filter events see at http://docs.splunk.com/Documentation/Splunk/6.6.0/Forwarding/Routeandfilterdatad
in other words, to take only events with srv.+|db.+|web.+ you have to configure:
[your_WMWare_Sourcetype] TRANSFORMS-set= setnull,setparsing
[setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = srv|db|web DEST_KEY = queue FORMAT = indexQueue
Restart Splunk Enterprise.
So in other words you can't really limit vmware performance data to specific hosts?
For example an event of sourcetype vmware:perf:power like this one would be send to the nullQueue because the event doesn't have the actual host name in it, only the uuid/vm_id.
vm-190316 501f3807-ad88-9616-f1b3-49edff4592c1 aggregated 20 111 5
I don't think this will work with the VMware performance data. The host of those events is the vCenter server you're collecting from, and the only reference to the VM is the uuid.
I guess it is not possible unfortunately.
The following lines should NOT be commented if you want to collect instance level data
hostinstancewhitelist = .*
vminstancewhitelist = .*
rpinstancewhitelist = .*
clusterinstancewhitelist = .*
Will probably have to collect data less frequently.