Getting Data In

What is a good way to compare all the VMs in a VMware vSphere with all of the universal forwarders I have installed?

lycollicott
Motivator

First off, let me say that we do not have plans to purchase the VMware app.

I would like to be able to identify any VMs which do not have the Universal Forwarder installed and I considered having the VMware team routinely provide me with a get-vm output in CSV format to create a lookup, but that seems awfully manual and error prone.

Any ideas? It's Monday, I'm feeling lazy and I don't want to reinvent the wheel if I don't have to.

0 Karma
1 Solution

vasildavid
Path Finder

The get-vm CSV is probably the best way. You can use that as an inputlookup with a |metadata command to find systems that have not recently sent you data like so:

| inputlookup append=t vmware_hosts 
| fields nt_host 
| where NOT [| metadata index=vmware type=hosts earliest=-1d@d latest=now
             | where lastTime > relative_time(now(), "-1d@d") 
             |  rex field=host "(?<nt_host>[^\.]+)" 
             | fields nt_host]
| sort nt_host

edit: added "probably the best way".

View solution in original post

vasildavid
Path Finder

The get-vm CSV is probably the best way. You can use that as an inputlookup with a |metadata command to find systems that have not recently sent you data like so:

| inputlookup append=t vmware_hosts 
| fields nt_host 
| where NOT [| metadata index=vmware type=hosts earliest=-1d@d latest=now
             | where lastTime > relative_time(now(), "-1d@d") 
             |  rex field=host "(?<nt_host>[^\.]+)" 
             | fields nt_host]
| sort nt_host

edit: added "probably the best way".

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!