VMware datastores with highest utilization
Datastores hold critical files needed for normal VMware operation. Like any other storage container, running out of space is bad. You want to see all the datastores in your environment according to the least percentage of free space remaining.
Data required
- VMware. This procedure depends on data primarily obtained from the Splunk Add-on for VMware Metrics; however, log and event data from the VMWare environment can also provide additional insights into general VMWare environment health. Therefore, for best performance, you should also download and install Splunk Add-on for VMware ESXi Logs and Splunk Add-on for vCenter Logs.
Procedure
- Ensure that you have installed the IT Essentials Work app to onboard VMware data and provide the various VMware entity type configurations and dashboards.
- Ensure that you are collecting VMware data through one or more Data Collection Nodes, which are essentially Splunk heavy forwarders with specific VMware collection configurations.
- Run the following search. You can optimize it by specifying an index and adjusting the time range.
| mstats latest(vsphere.datastore.used_percent) WHERE (index=vmware-perf-metrics) span=1m BY name, moid, pool_name, unit, vcenter
| eval used_percent=round('latest(vsphere.datastore.used_percent)',2)
| timechart latest(used_percent) BY name
Search explanation
The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.
| Splunk Search | Explanation |
|---|---|
| mstats latest(vsphere.datastore.used_percent) WHERE (index=vmware-perf-metrics) span=1m BY name, moid, pool_name, unit, vcenter |
Search metrics index(es) where VMWare datastore metrics are collected and split by the field shown. |
| eval used_percent=round('latest(vsphere.datastore.used_percent)',2) |
Create a new field named used_percent and round the value to two decimals for readability. |
| timechart latest(used_percent) BY name |
Plot the datastore usage over time. |
Next steps
A potential next step is to correlate this data with asset identification data such as department, business usage, criticality, and similar attributes to further help with identification of opportunities for optimization and planning. This can be done with a lookup using the datastore ID or the url as the key into the lookup.
To alert when average datastore utilization is nearing max capacity, you can configure one of the following two recommendations:
- Use the SPL from this procedure to configure a Splunk platform alert.
- Configure the average datastore usage vital metric for the VMware Datastore entity type in IT Essentials Work to alert when the VMware datastore utilization percentage is at or near 100.
Finally, you might be interested in other processes associated with the Monitoring VMware virtual machine performance use case.