I just ran a test with the default configuration, trimmed it down to just the default and vc stanza.
date;perl ../bin/Engine.pm -e /home/splunkadmin/opt/splunk/etc/apps/Splunk_TA_vmware/local/test_cluster_perf.conf | grep clSvcs
Thu Jan 31 10:33:28 PST 2013
2013-01-31 18:35:00 UTC, fa=cluster_test,vc="APPS-VCENTER500", vmoid=domain-c8,meid="vc-389C22BD-5080-43F6-AB59-D71A5034107F:domain-c8", moname=Apps-SV5, perftype=clSvcs, AvgEffCpu_MHz=23817.00, AvgEffMem_MB=64407.00, perftype=clSvcs
2013-01-31 18:40:00 UTC, fa=cluster_test,vc="APPS-VCENTER500", vmoid=domain-c8,meid="vc-389C22BD-5080-43F6-AB59-D71A5034107F:domain-c8", moname=Apps-SV5, perftype=clSvcs, AvgEffCpu_MHz=23817.00, AvgEffMem_MB=64410.00, perftype=clSvcs
Despite the timestamps on the data itself it took me a long time to actually get the data, to the tune of about 20 minutes. The reason for this is that when you start up it is going to look for data from the time you started, but vCenter calculates the cluster services data based on virtual machine data that comes in so there is a significant delay in its acquisition. If you have not tried yet, do a longer running test say an hour or so either by feeding the data into splunk normally of if you prefer using the command I have provided above (i ran from the local dir hence the ../bin).
For reference my conf was:
[default]
fa = cluster_test
perfTypeWhitelist = ^cpu$|^mem$|^disk$|^net$|^clSvcs$
hostPerfCounterWhitelist =^AvgAct_KB$|^AvgConsum_KB$|^AvgGrtd_KB$|^AvgOvrhd_KB$|^AvgQueLat_ms$|^AvgRd$|^AvgRvcd_KBps$|^AvgSwpIn_KB$|^AvgSwpOut_KB$|^AvgTotLat_ms$|^AvgUsg_KBps$|^AvgUsg_pct$|^AvgVmctl_KB$|^AvgWr$|^AvgXmit_KBps$|^SumBusResets$|^SumCmdsAbort$|^SumRd$|^SumRdy_ms$|^SumWr$|^AvgSwpUsd_KB$
vmPerfCounterWhitelist =^AvgAct_KB$|^AvgConsum_KB$|^AvgGrtd_KB$|^AvgOvrhd_KB$|^AvgQueLat_ms$|^AvgRd$|^AvgRvcd_KBps$|^AvgSwpIn_KB$|^AvgSwpOut_KB$|^AvgSwpd_KB$|^AvgTotLat_ms$|^AvgUsg_KBps$|^AvgUsg_pct$|^AvgVmctl_KB$|^AvgWr$|^AvgXmit_KBps$|^SumBusResets$|^SumCmdsAbort$|^SumRd$|^SumRdy_ms$|^SumWr$|^AvgUsg_mhz$
[vcvcnum0n0]
url = https://apps-vcenter500/sdk/webService
username = svc_tfletcher
password = password
perfInstanceData = ON
interval = 5
action = PerfDiscovery
perfManagedEntityWhitelist = ClusterComputeResource|ResourcePool
Failing that you may want to look at collection level. If you'll notice I have the instance data turned on which implies a higher performance collection level. If your vCenter is configured to a low performance collection level, i.e. 1 or 2 then it may not gather requisite performance information. I am not sure this is a big risk but it may be worth looking into.
... View more