VMWare APP Usage

[matthewparry]

Hi,

Is it possible to get a daily indexed total per ESX(Host) and VC rather than an indexed daily total for the entire vmware index?
The APP uses multiple indexes also, so it would need to take into consideration these?

Maybe something like:

index=_internal source=*license_usage.log type=Usage | eval MB=b/1024/1024 | timechart span=1d sum(MB) by h useother=false

[ayme]

I believe Tuxford's search is not 100% reliable because Splunk only logs the top few volume-generating hosts in the internal log.

Calculating the raw bytes of a message is often a good indicator:

index=vmware host=esxi* | eval bytes=len(_raw) | stats sum(bytes) as bytes by host | eval bytes/1024/1024

Although I believe meta data also counts towards indexing volume so the above search isn't 100% either (but likely to be close enough)

[tuxford]

Maybe this one can be tweaked to your needs?

index="_internal" source="*metrics.log" per_host_thruput series="*esxi*" OR series="*vc*" | eval MB=kb/1024 | chart sum(MB) by series

[tuxford]

If you go Status - Index activity - Indexing volume you can split by index, source, sourcetype and host.