I am trying to monitor physical hosts, to see instantly which one is the problem. ATM i have to lock up the virtual machines to see which phy host ist affected.
SII can monitor any supported technology [1], regardless of how it's actually being run under-the-hood. You can monitor physical hosts, virtual machines, Docker containers, and more.
[1] https://docs.splunk.com/Documentation/Infrastructure/latest/Admin/AddData