You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
176 lines
9.6 KiB
176 lines
9.6 KiB
# Copyright (C) 2005-2021 Splunk Inc. All Rights Reserved.
|
|
|
|
[(?::){0}vmware*]
|
|
EVAL-app = "vmware"
|
|
EVAL-vendor = "VMWare, Inc."
|
|
|
|
[vmware:perf:cpu]
|
|
KV_MODE = multi_tsv
|
|
FIELDALIAS-extract_cpu_perf = p_average_cpu_usagemhz_megaHertz as cpu_load_mhz, p_summation_cpu_run_millisecond as cpu_time, p_average_cpu_demand_megaHertz as cpu_demand
|
|
EVAL-cpu_allocation_percent = (p_average_cpu_reservedCapacity_megaHertz/p_average_cpu_totalCapacity_megaHertz)*100
|
|
EVAL-cpu_load_percent = if(instance="aggregated", p_average_cpu_usage_percent, null)
|
|
|
|
[vmware:perf:disk]
|
|
KV_MODE = multi_tsv
|
|
FIELDALIAS-extract_disk_perf = p_latest_disk_maxTotalLatency_millisecond as latency, p_average_disk_deviceLatency_millisecond as storage_device_latency, p_average_disk_kernelLatency_millisecond as os_storage_latency, p_average_disk_queueLatency_millisecond as storage_queue_latency, p_average_disk_usage_kiloBytesPerSecond as storage_usage, p_latest_disk_maxTotalLatency_millisecond as highest_latency
|
|
|
|
[vmware:perf:mem]
|
|
KV_MODE = multi_tsv
|
|
FIELDALIAS-extract_memory_usage = p_average_mem_usage_percent as mem_usage_percent
|
|
EVAL-mem_used = p_average_mem_consumed_kiloBytes/1024
|
|
EVAL-mem_committed = p_average_mem_granted_kiloBytes/1024
|
|
EVAL-mem_free = p_average_mem_heapfree_kiloBytes/1024
|
|
EVAL-swap_used = p_average_mem_swapused_kiloBytes/1024
|
|
EVAL-mem = p_average_mem_totalCapacity_megaBytes
|
|
EVAL-mem_provisioned = p_average_mem_vmmemctl_kiloBytes*1024
|
|
EVAL-mem_reserved = p_average_mem_compressed_kiloBytes*1024
|
|
EVAL-mem_page_rate =(p_average_mem_swapinRate_kiloBytesPerSecond + p_average_mem_swapoutRate_kiloBytesPerSecond)/4
|
|
|
|
[vmware:perf:clusterServices]
|
|
KV_MODE = multi_tsv
|
|
|
|
[vmware:perf:datastore]
|
|
KV_MODE = multi_tsv
|
|
FIELDALIAS-extract_datastore_perf = instance as datastore_id, p_average_datastore_totalReadLatency_millisecond as read_latency, p_average_datastore_totalWriteLatency_millisecond as write_latency
|
|
EVAL-storage_usage = p_average_datastore_read_kiloBytesPerSecond + p_average_datastore_write_kiloBytesPerSecond
|
|
EVAL-datastore_read_latency = if(source="VMPerf:HostSystem", p_average_datastore_totalReadLatency_millisecond, null)
|
|
EVAL-datastore_write_latency = if(source="VMPerf:HostSystem", p_average_datastore_totalWriteLatency_millisecond, null)
|
|
EVAL-storage_used_percent=(storage_committed/(storage_committed+storage_uncommitted))*100
|
|
EVAL-datastore_used_percent=((datastore_capacity-datastore_freespace)/datastore_capacity)*100
|
|
|
|
[vmware:perf:hbr]
|
|
KV_MODE = multi_tsv
|
|
|
|
[vmware:perf:managementAgent]
|
|
KV_MODE = multi_tsv
|
|
|
|
[vmware:perf:net]
|
|
KV_MODE = multi_tsv
|
|
FIELDALIAS-extract_network_perf = instance as nic_id, p_average_net_received_kiloBytesPerSecond as network_usage_in, p_average_net_transmitted_kiloBytesPerSecond as network_usage_out, p_summation_net_droppedRx_number as packets_dropped_in, p_summation_net_droppedTx_number as packets_dropped_out
|
|
EVAL-thruput = p_average_net_transmitted_kiloBytesPerSecond/1024
|
|
EVAL-network_usage = if(instance="aggregated", p_average_net_usage_kiloBytesPerSecond, null)
|
|
|
|
[vmware:perf:rescpu]
|
|
KV_MODE = multi_tsv
|
|
|
|
[vmware:perf:power]
|
|
KV_MODE = multi_tsv
|
|
|
|
[vmware:perf:storageAdapter]
|
|
KV_MODE = multi_tsv
|
|
|
|
[vmware:perf:storagePath]
|
|
KV_MODE = multi_tsv
|
|
|
|
[vmware:perf:sys]
|
|
KV_MODE = multi_tsv
|
|
FIELDALIAS-extract_sys_perf = p_latest_sys_uptime_second as uptime
|
|
|
|
[vmware:perf:vcDebugInfo]
|
|
KV_MODE = multi_tsv
|
|
|
|
[vmware:perf:vcResources]
|
|
KV_MODE = multi_tsv
|
|
|
|
[vmware:perf:virtualDisk]
|
|
KV_MODE = multi_tsv
|
|
|
|
[vmware:perf:vmop]
|
|
KV_MODE = multi_tsv
|
|
|
|
[vmware:perf:vflashModule]
|
|
KV_MODE = multi_tsv
|
|
|
|
[vmware:events]
|
|
FIELDALIAS-extract_vm_alert_change = eventClass as type, key as id, host as src, fullFormattedMessage as subject, host as dest, role.name as object, privilegeList{} as object_attrs, role.roleId as object_id, userName as user
|
|
EVAL-change_type = if(isnotnull(object), "role", "N/A")
|
|
EVAL-product = "SplunkForVmware"
|
|
EVAL-action = case(eventClass=="RoleRemovedEvent", "deleted", eventClass=="RoleAddedEvent", "created", eventClass=="RoleUpdatedEvent", "modified", 1==1, "unknown")
|
|
KV_MODE = json
|
|
|
|
[vmware:tasks]
|
|
KV_MODE = json
|
|
|
|
[vmware:inv:datastore]
|
|
KV_MODE = json
|
|
FIELDALIAS-extract_datastore_inv = changeSet.host.DatastoreHostMount.mountInfo{}.path as mount, changeSet.summary.url as root_url, changeSet.summary.type as root_volume_type, changeSet.summary.capacity as storage_capacity, changeSet.summary.accessible as accessible
|
|
EVAL-storage = $changeSet.info.vmfs.capacity$/1024
|
|
EVAL-storage_free = $changeSet.info{}.freeSpace$/1024
|
|
EXTRACT-datastore_id = ds:\/\/\/vmfs\/volumes\/(?<datastore_id>.*?)\/[\"\n\s\t\b]?.*$ in datastore_url
|
|
EVAL-committed = $changeSet.summary.capacity$-$changeSet.summary.freeSpace$
|
|
EVAL-storage_free_space = coalesce($changeSet.summary.freeSpace$,$changeSet.summary{}.freeSpace$)
|
|
EVAL-uncommitted = coalesce($changeSet.summary.uncommitted$,$changeSet.summary{}.uncommitted$)
|
|
EVAL-root_path = coalesce($changeSet.info.vmfs.extent{}.diskName$,$changeSet.info.nas.remotePath$)
|
|
|
|
[vmware:inv:hostsystem]
|
|
KV_MODE = json
|
|
FIELDALIAS-extract_host_inv = changeSet.summary.config.product.productLineId as family, changeSet.summary.config.product.vendor as vendor, changeSet.summary.config.product.licenseProductName as product, changeSet.summary.hardware.numCpuCores as cpu_cores, changeSet.summary.hardware.numCpuThreads as cpu_count, changeSet.summary.hardware.cpuMhz as cpu_mhz, changeSet.summary.config.product.osType as os, changeSet.summary.config.product.version as version, changeSet.name as dest, changeSet.config.hyperThread.config as hyperthreading, changeSet.summary.hardware.cpuModel as processor, changeSet.summary.hardware.numCpuThreads as logical_cpu_count, changeSet.summary.hardware.numNics as nic_count, changeSet.summary.hardware.numCpuPkgs as processor_socket_count, changeSet.summary.hardware.memorySize as mem_capacity, cluster.moid as cluster_id, cluster.name as cluster_name, datastores{}.accessible as accessible, datastores{}.name as datastore, changeSet.summary.config.product.osType as hypervisor_os, changeSet.summary.config.product.version as hypervisor_os_version, datacenter.name as datacenter
|
|
EVAL-enabled = isnotnull(moid)
|
|
EVAL-mem = $changeSet.summary.hardware.memorySize$/1024
|
|
EVAL-vendor_product = vendor + "_" + product
|
|
REPORT-exctractdatastoreid = exctract_datastore_id
|
|
|
|
[vmware:inv:vm]
|
|
KV_MODE = json
|
|
FIELDALIAS-extract_vm_inv = changeSet.storage.perDatastoreUsage{}.datastore.moid as mount, changeSet.guest.ipAddress as ip, changeSet.guest.net.GuestNicInfo{}.macAddress as mac, changeSet.guest.ipStack{}.dnsConfig.domainName as dns, changeSet.guest.toolsStatus as status, changeSet.guest.toolsVersion as tools_version, changeSet.snapshot.rootSnapshotList{}.name as snapshot, changeSet.snapshot.rootSnapshotList{}.description as description, changeSet.snapshot.rootSnapshotList{}.createTime as time, changeSet.summary.runtime.powerState as power_state, changeSet.config.guestFullName as vm_os, changeSet.config.hardware.numCoresPerSocket as cpu_cores, changeSet.config.datastoreUrl{}.name as datastore, changeSet.config.datastoreUrl{}.url as datastore_volume_path, changeSet.summary.runtime.host.uuid as hypervisor_id, changeSet.summary.runtime.host.name as hypervisor_name, changeSet.summary.storage.uncommitted as uncommitted, changeSet.summary.quickStats.uptimeSeconds as vm_uptime, datastores{}.accessible as accessible, changeSet.summary.storage.committed as committed, cluster.moid as cluster_id, cluster.name as cluster_name, changeSet.config.hardware.numCPU as logical_cpu_count
|
|
FIELDALIAS-extract_product_version = changeSet.config.guestFullName as product_version
|
|
EVAL-storage_used = $changeSet.storage.perDatastoreUsage{}.committed$/1024
|
|
EVAL-storage_capacity = ($changeSet.summary.storage.uncommitted$ + $changeSet.summary.storage.committed$)
|
|
EVAL-mem_capacity = $changeSet.summary.config.memorySizeMB$*1024*1024
|
|
EVAL-vendor_product = "VMWare, Inc." + "_" + 'changeSet.config.guestFullName'
|
|
REPORT-extractosversion = extract_os_version
|
|
REPORT-exctractdatastoreid = exctract_datastore_id
|
|
|
|
[vmware:inv:clustercomputeresource]
|
|
KV_MODE = json
|
|
|
|
[vmware:inv:hierarchy]
|
|
KV_MODE = json
|
|
|
|
[vmware:inv:resourcepool]
|
|
KV_MODE = json
|
|
|
|
[source::.../var/log/splunk/ta_vmware_hierarchy_agent*]
|
|
REPORT-hydraloggerfields = hydra_logger_fields
|
|
|
|
[source::VMPerf:HostSystem]
|
|
FIELDALIAS-hypervisor_id = uuid as hypervisor_id
|
|
|
|
[source::VMPerf:VirtualMachine]
|
|
FIELDALIAS-vm_id = uuid as vm_id
|
|
|
|
# Adding the below extraction stanzas in order to populate the Hydra troubleshooting dashboards and to remove SA-Hydra dependency from Search Head. Changes performed in VMW-6087
|
|
|
|
[source::.../var/log/splunk/hydra_scheduler*]
|
|
LINE_BREAKER = ([\r\n]+)\d\d\d\d-\d\d-\d\d\s\d\d:\d\d:\d\d
|
|
BREAK_ONLY_BEFORE = \d\d\d\d-\d\d-\d\d\s\d\d:\d\d:\d\d
|
|
SHOULD_LINEMERGE = false
|
|
REPORT-schedulerfields = hydra_scheduler_log_fields
|
|
sourcetype = hydra_scheduler
|
|
|
|
[source::.../var/log/splunk/hydra_worker*]
|
|
LINE_BREAKER = ([\r\n]+)\d\d\d\d-\d\d-\d\d\s\d\d:\d\d:\d\d
|
|
BREAK_ONLY_BEFORE = \d\d\d\d-\d\d-\d\d\s\d\d:\d\d:\d\d
|
|
SHOULD_LINEMERGE = false
|
|
REPORT-workerfields = hydra_worker_log_fields
|
|
sourcetype = hydra_worker
|
|
|
|
[source::.../var/log/splunk/hydra_gateway*]
|
|
LINE_BREAKER = ([\r\n]+)\d\d\d\d-\d\d-\d\d\s\d\d:\d\d:\d\d
|
|
BREAK_ONLY_BEFORE = \d\d\d\d-\d\d-\d\d\s\d\d:\d\d:\d\d
|
|
SHOULD_LINEMERGE = false
|
|
REPORT-gatewayfields = hydra_gateway_log_fields
|
|
sourcetype = hydra_gateway
|
|
|
|
[source::.../var/log/splunk/hydra_gatekeeper*]
|
|
LINE_BREAKER = ([\r\n]+)\d\d\d\d-\d\d-\d\d\s\d\d:\d\d:\d\d
|
|
BREAK_ONLY_BEFORE = \d\d\d\d-\d\d-\d\d\s\d\d:\d\d:\d\d
|
|
SHOULD_LINEMERGE = false
|
|
sourcetype = hydra_gatekeeper
|
|
|
|
[source::.../var/log/splunk/hydra_access*]
|
|
LINE_BREAKER = ([\r\n]+)\d\d\d\d-\d\d-\d\d\s\d\d:\d\d:\d\d
|
|
BREAK_ONLY_BEFORE = \d\d\d\d-\d\d-\d\d\s\d\d:\d\d:\d\d
|
|
SHOULD_LINEMERGE = false
|
|
REPORT-gatewayfields = hydra_access_log_fields
|
|
sourcetype = hydra_access |