Skip to main content
Splunk Lantern

VMotion events for a specific virtual machine

 

VMotion is the process of moving a virtual machine from one ESXi host to another in an effort to balance the workload of all virtual machines as evenly and effectively as possible.

While the VMotion process is seamless to the virtual machine operation, it can impact performance. You want to monitor virtual machines being moved from one ESXi host to another so you can be prepared for any problems caused by the process. 

Data required 

Procedure

  1. Ensure that you have installed the IT Essentials Work app to onboard VMware data and provide the various VMware entity type configurations and dashboards.
  2. Ensure that you are collecting VMware data through one or more Data Collection Nodes, which are essentially Splunk heavy forwarders with specific VMware collection configurations. 
  3. Run the following search. You can optimize it by specifying an index and adjusting the time range.
index=vmware-taskevent sourcetype="vmware_inframon:events" eventClass="VmMigratedEvent" vm.name="<VM_NAME>"
| stats count BY vm.name, eventClass, createdTime, sourceHost.name, host.name, sourceDatastore.datastore.moid, ds.datastore.moid, _time
| rename vm.name AS "VM" eventClass AS "Event Type" createdTime AS "Completed Time" host.name AS "Dest. ESXi" sourceHost.name AS "Src ESXi" sourceDatastore.datastore.moid AS "Src Datastore" ds.datastore.moid AS "Dest.Datastore" 
| fields - count

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation
index=vmware-taskevent sourcetype="vmware_inframon:events" eventClass="VmMigratedEvent" vm.name="<VM_NAME>"

Search index vmware-taskevent for Virtual Machine migrated events. 

Replace <VM_NAME> with the Virtual Machine name or use * for all VMotions.

| stats count BY vm.name, eventClass, createdTime, sourceHost.name, host.name, sourceDatastore.datastore.moid, ds.datastore.moid, _time

Search only virtual machines.

| rename vm.name AS "VM" eventClass AS "Event Type" createdTime AS "Completed Time" host.name AS "Dest. ESXi" sourceHost.name AS "Src ESXi" sourceDatastore.datastore.moid AS "Src Datastore" ds.datastore.moid AS "Dest.Datastore" 

Rename the fields as shown for readability.

| fields - count

Remove the count field from the results.

Next steps

Provide this data to application teams so they can correlate VMWare activity with application performance and behavior.

You might be interested in other processes associated with the Monitoring VMware virtual machine performance use case.