You might need to see your VMware datastores with the highest utilization when doing the following:
In order to execute this procedure in your environment, the following data, services, or apps are required:
Datastores hold critical files needed for normal VMware operation. Like any other storage container, running out of space is bad. You want to see all the datastores in your environment according to the least percentage of free space remaining.
To optimize the search shown below, you should specify an index and a time range.
- Ensure that you have installed the IT Essentials Work app to onboard VMware data and provide the various VMware entity type configurations and dashboards.
- Ensure that you are collecting VMware data through one or more Data Collection Nodes, which are essentially Splunk heavy forwarders with specific VMware collection configurations.
- Run the following search:
| mstats latest(vsphere.datastore.used_percent) WHERE (index=vmware-perf-metrics) span=1m BY name, moid, pool_name, unit, vcenter | eval used_percent=round('latest(vsphere.datastore.used_percent)',2) | timechart latest(used_percent) BY name
The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.
|| mstats latest(vsphere.datastore.used_percent) WHERE (index=vmware-perf-metrics) span=1m BY name, moid, pool_name, unit, vcenter||Search metrics index(es) where VMWare datastore metrics are collected and split by the field shown.|
|| eval used_percent=round('latest(vsphere.datastore.used_percent)',2)||Create a new field named "used_percent" and round the value to two decimals for readability.|
|| timechart latest(used_percent) BY name||Plot the datastore usage over time.|
A potential next step is to correlate this data with asset identification data such as department, business usage, criticality, and similar attributes to further help with identification of opportunities for optimization and planning. This can be done with a lookup using the datastore ID or the url as the key into the lookup.
To alert when Average Datastore Utilization is nearing max capacity, you can configure one of the following two recommendations:
- Use the SPL from this procedure to configure a Core Splunk alert.
- Configure the Average Datastore Usage vital metric for the VMware Datastore entity type in IT Essentials - Work to alert when the VMware Datastore Utilization percentage is at or near 100.