Syntax for vm_instance_whitelist in vmware addon

[jihape]

The vmware add-on is creating too much data for us, so we wanted to limit the performance metrics to a subset of VMs (guests), but we can't seem to get the syntax right.

I've been adding vm_instance_whitelist = to ta_vmware_collection.conf under the vmware addon, but I haven't had any success yet.

First I tried with a regular expression like this (srv.+|db.+|web.+) but that didn't work, then I tried with srv.+,db.+,web.+ and didn't seem to work either.

If anyone knows how to do it please let me know.

[gcusello]

Hi jihape,
to filter events see at http://docs.splunk.com/Documentation/Splunk/6.6.0/Forwarding/Routeandfilterdatad
in other words, to take only events with srv.+|db.+|web.+ you have to configure:
props.conf

[your_WMWare_Sourcetype]
TRANSFORMS-set= setnull,setparsing

transforms.conf

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = srv|db|web
DEST_KEY = queue
FORMAT = indexQueue

Restart Splunk Enterprise.

Bye.
Giuseppe

[jihape]

So in other words you can't really limit vmware performance data to specific hosts?

For example an event of sourcetype vmware:perf:power like this one would be send to the nullQueue because the event doesn't have the actual host name in it, only the uuid/vm_id.

vm-190316 501f3807-ad88-9616-f1b3-49edff4592c1 aggregated 20 111 5

[gcusello]

in the props.conf stanza header you can also use host

[host::your_host]

but I always prefer to use sourcetype.
Bye.
Giuseppe

[jihape]

I don't think this will work with the VMware performance data. The host of those events is the vCenter server you're collecting from, and the only reference to the VM is the uuid.

I guess it is not possible unfortunately.

The following lines should NOT be commented if you want to collect instance level data

host_instance_whitelist = .*
vm_instance_whitelist = .*

rp_instance_whitelist = .*

cluster_instance_whitelist = .*

Will probably have to collect data less frequently.