Skip to main content

 

Splunk Lantern

Virtual machines with large file size utilization

You might need to see which virtual machines are consuming large amounts of file space when doing the following:

Prerequisites 

In order to execute this procedure in your environment, the following data, services, or apps are required:

Example

VMware stores several critical files for each virtual machine. Depending on configurations or usage, the overall space consumed by these files might grow large. In some cases, excessive snapshotting might be contributing to the overall file size. You want to identify virtual machines consuming large amounts of file space to determine if you can perform any cleanup to reduce the amount of space being used.

  1. Ensure that you have installed the IT Essentials Work app to onboard VMware data and provide the various VMware entity type configurations and dashboards.
  2. Ensure that you are collecting VMware data through one or more Data Collection Nodes, which are essentially Splunk heavy forwarders with specific VMware collection configurations. 
  3. Run the following search: 
| mstats latest(vsphere.vm.datastore.storage_committed) AS storage_committed latest(vsphere.vm.datastore.storage_uncommitted) AS storage_uncommitted latest(vsphere.vm.datastore.storage_used_percent) AS storage_used_percent WHERE (index=vmware-perf-metrics) AND entity_type=vsphere.vm span=1m BY name 
| dedup name sortby - _time 
| eval total_file_size_gb=round(storage_committed/1024/1024/1024,2), used_percent=round(storage_used_percent,2), total_uncommitted_gb=round(storage_uncommitted/1024/1024/1024,2), total_available_storage_gb=(total_file_size_gb+total_uncommitted_gb)
| sort - total_file_size_gb
| fields - storage_committed storage_uncommitted storage_used_percent
| table name total_file_size_gb total_uncommitted_gb total_available_storage_gb used_percent
| rename name AS "Virtual Machine"

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation
| mstats latest(vsphere.vm.datastore.storage_committed) AS storage_committed latest(vsphere.vm.datastore.storage_uncommitted) AS storage_uncommitted latest(vsphere.vm.datastore.storage_used_percent) AS storage_used_percent WHERE (index=vmware-perf-metrics) AND entity_type=vsphere.vm span=1m BY name 

Search only VMware datastore inventory data.

| dedup name sortby - _time 

Remove duplicate managed object IDs (MOIDs).

| eval total_file_size_gb=round(storage_committed/1024/1024/1024,2), used_percent=round(storage_used_percent,2), total_uncommitted_gb=round(storage_uncommitted/1024/1024/1024,2), total_available_storage_gb=(total_file_size_gb+total_uncommitted_gb) Convert bytes to gigabytes and round per metric.
| sort - total_file_size_gb

Sort results with the virtual machines taking up the most space first.

| fields - storage_committed storage_uncommitted storage_used_percent Remove the fields shown from the results.
| table name total_file_size_gb total_uncommitted_gb total_available_storage_gb used_percent Display the results in a table with columns in the order shown.
| rename name AS "Virtual Machine" Rename the field shown for better readability.

Result

The table below shows sample results for the search. This data gives good insight on where space is consumed on a per VM basis and can be used to determine where to optimize space.  

moid total_files total_file_size_gb snapshots

vm-18

15

83.55

0

vm-211

18

24.56

0

vm-209

20

24.25

0

vm-192

21

24.16

0

vm-234

20

24.16

0

  • Was this article helpful?