I have vmware view data going into splunk and i currently send alerts to an email group if a pooled image (TotalVMs>1) has less then 3 vms available (availableVMs is <3).
However, i would like to create a dashboard for this to be displayed as well. Showing a pie chart of TotalVMs/availablevms/busyvms/poweredoffvms.
All of this information is in one line in splunk, however I have about 20-30 pools (working on consolidation) and would like the dashboard to show all of the pools and a pie chart for each with the status mentioned above. Here are 3 lines extract from my log upload from vmware view broker. Any help or direction would be greatly appreciated.
2014-03-21T07:39:28.585-05:00 DEBUG (0A38-115C)
host=Viewbroker Options| sourcetype=vmware-view Options| source=C:\ProgramData\VMware\VDM\logs\debug-2014-03-21-071859.txt Options| availableVMs=7 Options| totalVMs=70 Options
2014-03-21T07:39:28.584-05:00 DEBUG (0A38-115C)
host=Viewbroker Options| sourcetype=vmware-view Options| source=C:\ProgramData\VMware\VDM\logs\debug-2014-03-21-071859.txt Options| availableVMs=7 Options| totalVMs=17 Options
2014-03-21T07:39:28.583-05:00 DEBUG (0A38-115C)
host=Viewbroker Options| sourcetype=vmware-view Options| source=C:\ProgramData\VMware\VDM\logs\debug-2014-03-21-071859.txt Options| availableVMs=5 Options| totalVMs=10 Options
Simplest options will be to run the searches your have and save it as dashboard panel.
sample search (Table)
your base search | stats first(totalVMs) as totalVMs, first(availableVMs) as availableVMs , first(poweredOffVMs) as poweredOffVMs first(busyVMs) as busyVMs by cn | rename cn as poolName
Piechart: (change the field name in stats to generate pie chart for other fields)
your base search | stats first(totalVMs) as totalVMs by cn | rename cn as poolName
Simplest options will be to run the searches your have and save it as dashboard panel.
sample search (Table)
your base search | stats first(totalVMs) as totalVMs, first(availableVMs) as availableVMs , first(poweredOffVMs) as poweredOffVMs first(busyVMs) as busyVMs by cn | rename cn as poolName
Piechart: (change the field name in stats to generate pie chart for other fields)
your base search | stats first(totalVMs) as totalVMs by cn | rename cn as poolName
Great, i was able to use that information to finalize what I wanted. Not exactly how I wanted it to appear, but it is a good start.