Splunk Search

total vm's in esxi server

dall
Path Finder

i have extracted from logs how many are running but not able to write query for how many are present in server.

can anyone help on this???

Labels (1)
0 Karma

dall
Path Finder

 

 i have tried this but wrong result getting

index=" " host=" " | rex "\/[^\/]*\/[^\/]*\/[^\/]*\/(?<VMX>[^\.]*)\.vmx"| rex "(?<VMX>[^\/]+)\.vmx" | stats count by VMX | fields - count | stats count

 

i want to extract how many vm's are present and how many running and stopped status of vm

 my events are like this

[Originator@6876 sub=Vmsvc.vm:/vmfs/volumes/5c29d53f-db838d67-eceb-64006a7385ee/windows10_test_PT/windows10_test_PT.vmx] CacheDatastores: fileBacking [] /windows.iso has null datastore reference <13>Injector: Sleeping!

 

[Originator@6876 sub=Vmsvc.vm:/vmfs/volumes/5c29d53f-db838d67-eceb-64006a7385ee/windows10_test_PT/windows10_test_PT.vmx] Send config update invoked

[Originator@6876 sub=Vmsvc.vm:/vmfs/volumes/5b644667-2570bf2b-f8b4-a0369fe19fa4/packer_ubuntu20/packer_ubuntu20.vmx] Send config update invoked

 

[Originator@6876 sub=Vmsvc.vm:/vmfs/volumes/5b644667-2570bf2b-f8b4-a0369fe19fa4/Ansible/Ansible.vmx opID=f8c92b55 user=root] State Transition (VM_STATE_SETTING_SCREEN_RES -> VM_STATE_ON)

[Originator@6876 sub=Vmsvc.vm:/vmfs/volumes/5b644667-2570bf2b-f8b4-a0369fe19fa4/Ansible/Ansible.vmx opID=f8c92b55 user=root] State Transition (VM_STATE_SETTING_SCREEN_RES -> VM_STATE_ON)

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The second rex effectively overwrites the first. What this appears to be doing is counting the distinct VMs by assuming they are uniquely identified by whatever is between the last / and the .vmx

-- your search
| rex "(?<VMX>[^\/]+)\.vmx" | stats dc(VMX)

Is this what you intended? 

Also, for the second part, what events in the log tell you whether the vm is running or stopped?

0 Karma

dall
Path Finder

i have 4 sourcetype and each sourcetype i have extracted vm name but in query while using all sourcetype only 1st sourctype result of vm showing 

how i can use all sourcetype and list all vm's

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How are you including all source types in your search?

index=* sourcetype=A OR sourcetype=B OR sourcetype=C OR sourcetype=D

Note that you have to use capitals for "OR" not "or"

0 Karma

dall
Path Finder

yes like this only i used but only 1st sourcetype result showing

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you share your full query?

0 Karma

dall
Path Finder

 

index=* sourcetype=A OR sourcetype=B OR sourcetype=C OR sourcetype=D | stats count by VMName

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This is missing the rex - try

index=* sourcetype=A OR sourcetype=B OR sourcetype=C OR sourcetype=D 
| rex "(?<VMName>[^\/]+)\.vmx" 
| stats dc(VMName)

 

0 Karma

dall
Path Finder

from 2 server i am getting correct result but for 3rd server i am running same query but not getting correct result

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Sounds like you have found your problem - what is different about server 3 or at least the logs you receive from it?

0 Karma

dall
Path Finder

yes, how i ll get that in each server how many vm's are present

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How do you know which log message comes from which server?

0 Karma

dall
Path Finder

index=" " ".vmx" there that one is showing  how many sourcetype and each sourcetype i am checking events 

is there any other way ??

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I am not sure I understand - is each sourcetype a different server and you want the count of VM for each sourcetype?

index=* sourcetype=A OR sourcetype=B OR sourcetype=C OR sourcetype=D 
| rex "(?<VMName>[^\/]+)\.vmx" 
| stats dc(VMName) by sourcetype
0 Karma

dall
Path Finder

not getting correct result

is there any condition i have to apply to know which are running and which are stopped??

0 Karma

dall
Path Finder

3 server with multiple sourcetype but only 4 sourcetype of each server vmname is present..so by extracting those vmname i am showing but only running vm showing 

how i can show total vm's which are present in each server??

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=* sourcetype=A OR sourcetype=B OR sourcetype=C OR sourcetype=D 
| rex "(?<VMName>[^\/]+)\.vmx" 
| stats dc(VMName) by sourcetype, host

Hopefully, the indexers/forwarders will have added a field called host to indicate where the log originated.

0 Karma

dall
Path Finder

sorry, this is not what i am expecting

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Then you have to explain how you identify which server the events are coming from

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you provide example log events and show what you already have tried?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...