In the 2.0 view, snapshot information was put under the "datastore_detail" view. You can see a breakdown of storage based by datastore and also you can see snapshot usage under the vm_detail view. Due to popular request however, we're working on a dedicated snapshot view that will be released in a future version. In the mean time, you can grab the snapshot view from 1.0 and place it in the local data/ui/views directory and add it to the nav.xml, or access it directly. ... View more

With any dashboard in splunk, you can modify the dashboard's xml to have a "refresh" tag. Edit the home_proactive_mornitoring.xml header from: < view autoCancelInterval="120" decomposeIntentions="false" isPersistable="true" isSticky="true" isVisible="true" objectMode="viewconf" onunloadCancelJobs="false" template="splunk_for_vmware:/templates/dashboard.html"> to: < view refresh="1800" autoCancelInterval="120" decomposeIntentions="false" isPersistable="true" isSticky="true" isVisible="true" objectMode="viewconf" onunloadCancelJobs="false" template="splunk_for_vmware:/templates/dashboard.html"> The addition of refresh="1800" = refresh every 1800 seconds. See here for more info: Build a dashboard using advanced XML ... View more

Lockdown mode disables all access to the vsphere api. Even if you were to provide the root account information of the host, lockdown mode will still prevent us from gathering performance information from the hosts. In order to use the app to it's full capabilities, you are correct, you would need to disable lockdown mode. ... View more

Usually this is a sign that you are running the scripts with a username that does not have the proper rights on the target host. There also may be a chance you don't have a connection to the required ports on the hosts if they are indeed behind a firewall. Make sure you can access the MOB for the target host from the subnet of the splunk forwarder you are running the scripts from. The scripts communicate to the MOB through a soap transaction. The default ports you need open are 80 and 443. ... View more

The core postprocess module can not be used with a paginator. Sideview's PostProcess/pager module works around this core limitation. VMware will ship with a patch in the core paginator module that fixes this limitation and we are working with the core team to get this functionality back into our core product. ... View more

This is possible, see this post: ChartOverlays ... View more

you're setting the lineburshes on "chart" but then referencing "chart1" and "chart2" on the chart.layout. You need to have your respective charts use your brushpallette ... View more

The easiest way, simply add your directory you'd like to monitor on your forwarder through the gui prior to enabling it as a forwarder. If you've already done set the machine as a forwarder, simply follow the cli instructions for adding an input. Below is the link to the page in the documentation you're looking for: Configure your inputs ... View more

The transaction command deals with things in a "stream" fashion. What you're trying to do can be accomplished, and I feel you're right on the edge. First thing I want to touch on, the use of "startwith" and "endswith". These commands are to tell splunk when there is a hard end and a hard start to each transaction. The reason you are losing events, if splunk encounters items that do not follow the transaction start and end conditions, the event is "evicted" from the stream. I wrote a long post about how the transaction command works here: Transaction-Problems Next up, splunk is fine if you are overwriting the _time field, and you can do this as a personal preference. Really what you need is to simply run 2 sorts to have your stream in order, then bind them in a transaction, you can do this with or without overriding _time: [search]|sort -actionTimeStamp,-actionId | transaction SID This should sort all your events descending by actionTimeStamp, and then with any items that have the same actionTimeStamp, sort descending by actionId. The transaction command will then only stick together events that have the same SID and will get rid of any event that does not have SID populated. For speed increases, if you know there will only be 6 events per transaction, you can use transaction SID maxevents=6. Let me know if you have further questions. ... View more

For default settings without any configuration, yes you need an equals sign. You can always use any regex string to extract the key value pairs (example: $1::$2). You can also add any character to a list for key-value extraction. In transforms.conf, you'll just simply need to add a DELIMS block to your stanza: Here's a block from the docs: Transforms.conf DELIMS = <quoted string list> * NOTE: This attribute is only valid for search-time field extractions. * IMPORTANT: If a value may contain an embedded unescaped double quote character, such as "foo"bar", use REGEX, not DELIMS. An escaped double quote (\") is ok. * Optional. Used in place of REGEX when dealing with delimiter-based field extractions, where field values (or field/value pairs) are separated by delimiters such as colons, spaces, line breaks, and so on. * Sets delimiter characters, first to separate data into field/value pairs, and then to separate field from value. * Each individual character in the delimiter string is used as a delimiter to split the event. * Delimiters must be quoted with " " (use \ to escape). * When the event contains full delimiter-separated field/value pairs, you enter two sets of quoted characters for DELIMS: * The first set of quoted delimiters extracts the field/value pairs. * The second set of quoted delimiters separates the field name from its corresponding value. * When the event only contains delimiter-separated values (no field names) you use just one set of quoted delimiters to separate the field values. Then you use the FIELDS attribute to apply field names to the extracted values (see FIELDS, below). * Alternately, Splunk reads even tokens as field names and odd tokens as field values. * Splunk consumes consecutive delimiter characters unless you specify a list of field names. * The following example of DELIMS usage applies to an event where field/value pairs are seperated by '|' symbols and the field names are separated from their corresponding values by '=' symbols: [pipe_eq] DELIMS = "|", "=" * Defaults to "". check out this file in your splunk install for some samples: [$SPLUNK_HOME]/etc/system/README/transforms.conf.example ... View more