Skip to main content
Splunk Lantern

VMware datastores with highest utilization

You might need to see your VMware datastores with the highest utilization when doing the following:

Prerequisites 

In order to execute this procedure in your environment, the following data, services, or apps are required:

Example

Datastores hold critical files needed for normal VMware operation. Like any other storage container, running out of space is bad. You want to see all the datastores in your environment according to the least percentage of free space remaining.

NOTE: To optimize the search shown below, you should specify an index and a time range.

  1. Run the following search: 
sourcetype="vmware:inv:datastore"
|eval freeSpaceTrend = round('changeSet.summary.freeSpace' / 'changeSet.summary.capacity' * 100 , 2)
|stats sparkline(min(freeSpaceTrend),15m) AS freeSpaceTrend, latest(changeSet.summary.*) AS * BY host, moid
|eval percentFreeSpace = round(freeSpace/capacity*100,2)
|eval RemainingCapacity_GB=round(freeSpace/1024/1024/1024, 2)
|eval TotalCapacity_GB=round(capacity/1024/1024/1024, 2)
|table moid freeSpaceTrend percentFreeSpace RemainingCapacity_GB TotalCapacity_GB name url type
|sort percentFreeSpace
|search percentFreeSpace<40 
|rename percentFreeSpace AS "% Free" RemainingCapacity_GB AS "(GB) Free" TotalCapacity_GB AS "Total GB"

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation

sourcetype="vmware:inv:datastore"

Search only VMware datastore inventory data.

|eval freeSpaceTrend = round('changeSet.summary.freeSpace' / 'changeSet.summary.capacity' * 100 , 2)

Compute the most recent free space and capacity metrics.

|stats sparkline(min(freeSpaceTrend),15m) AS freeSpaceTrend, latest(changeSet.summary.*) AS * BY host, moid

Create a sparkline over time of the free space for each datastore for an inline visual of the trend. 

|eval percentFreeSpace = round(freeSpace/capacity*100,2)

Compute the free space and capacity metrics into a free space percentage.

|eval RemainingCapacity_GB=round(freeSpace/1024/1024/1024, 2)

|eval TotalCapacity_GB=round(capacity/1024/1024/1024, 2)

Convert all bytes to gigabytes for better readability.

|table moid freeSpaceTrend percentFreeSpace RemainingCapacity_GB TotalCapacity_GB name url type

Display the results in a table with columns in the order shown.

|sort percentFreeSpace

Sort results with the datastores with the smallest percent of free space first.

|search percentFreeSpace<40

Show only results where the percent of free space is less than 40.

|rename percentFreeSpace AS "% Free" RemainingCapacity_GB AS "(GB) Free" TotalCapacity_GB AS "Total GB"

Rename the fields as shown for better readability.

Result

The table below shows sample results for the search. (freeSpaceTrend was omitted because the sparkline can not be rendered in the below table.) This table provides insight into disk space utilization by the datastore ID. You can use it for capacity planning and to identify places for optimization. Maybe a particular data store needs to be cleaned up based on its size.  A potential next step is to correlate this data with asset identification data such as department, business usage, criticality, and similar attributes to further help with identification of opportunities for optimization and planning. This can be done with a lookup using the datastore ID or the url as the key into the lookup.  

moid % Free (GB) Free Total GB name url type

datastore-12

25.54

57.27

224.25

apps-esxi501

ds:///vmfs/volumes/4db8a666-90a63d63...-842b2b76ee25/

VMFS

datastore-19

27.17

60.94

224.25

apps-esxi502

ds:///vmfs/volumes/4db8b0ea-c3d93548...-842b2b7707c7/

VMFS

datastore-21

28.86

131.74

456.5

apps-esxi503

ds:///vmfs/volumes/4db8b7f8-5e96d465...-842b2b76dc7c/

VMFS

datastore-13

39.56

59.23

149.75

iSCSI_Store2

ds:///vmfs/volumes/4dd213d3-8136e4f0...-842b2b7707c7/

VMFS

  • Was this article helpful?