Skip to main content
Splunk Lantern

Virtual machines with large file size utilization

VMware stores several critical files for each virtual machine. Depending on configurations or usage, the overall space consumed by these files might grow large. In some cases, excessive snapshotting might be contributing to the overall file size. You want to identify virtual machines consuming large amounts of file space to determine if you can perform any cleanup to reduce the amount of space being used.

Data required 

Procedure

  1. Ensure that you have installed the IT Essentials Work app to onboard VMware data and provide the various VMware entity type configurations and dashboards.
  2. Ensure that you are collecting VMware data through one or more Data Collection Nodes, which are essentially Splunk heavy forwarders with specific VMware collection configurations. 
  3. Run the following search. You can optimize it by specifying an index and adjusting the time range.
| mstats latest(vsphere.vm.datastore.storage_committed) AS storage_committed latest(vsphere.vm.datastore.storage_uncommitted) AS storage_uncommitted latest(vsphere.vm.datastore.storage_used_percent) AS storage_used_percent WHERE (index=vmware-perf-metrics) AND entity_type=vsphere.vm span=1m BY name 
| dedup name sortby - _time 
| eval total_file_size_gb=round(storage_committed/1024/1024/1024,2), used_percent=round(storage_used_percent,2), total_uncommitted_gb=round(storage_uncommitted/1024/1024/1024,2), total_available_storage_gb=(total_file_size_gb+total_uncommitted_gb)
| sort - total_file_size_gb
| fields - storage_committed storage_uncommitted storage_used_percent
| table name total_file_size_gb total_uncommitted_gb total_available_storage_gb used_percent
| rename name AS "Virtual Machine"

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation
| mstats latest(vsphere.vm.datastore.storage_committed) AS storage_committed latest(vsphere.vm.datastore.storage_uncommitted) AS storage_uncommitted latest(vsphere.vm.datastore.storage_used_percent) AS storage_used_percent WHERE (index=vmware-perf-metrics) AND entity_type=vsphere.vm span=1m BY name 

Search only VMware datastore inventory data.

| dedup name sortby - _time 

Remove duplicate managed object IDs (MOIDs).

| eval total_file_size_gb=round(storage_committed/1024/1024/1024,2), used_percent=round(storage_used_percent,2), total_uncommitted_gb=round(storage_uncommitted/1024/1024/1024,2), total_available_storage_gb=(total_file_size_gb+total_uncommitted_gb) Convert bytes to gigabytes and round per metric.
| sort - total_file_size_gb

Sort results with the virtual machines taking up the most space first.

| fields - storage_committed storage_uncommitted storage_used_percent Remove the fields shown from the results.
| table name total_file_size_gb total_uncommitted_gb total_available_storage_gb used_percent Display the results in a table with columns in the order shown.
| rename name AS "Virtual Machine" Rename the field shown for better readability.

Next steps

The table below shows sample results for the search. This data gives good insight on where space is consumed on a per VM basis and can be used to determine where to optimize space.  

moid total_files total_file_size_gb snapshots

vm-18

15

83.55

0

vm-211

18

24.56

0

vm-209

20

24.25

0

vm-192

21

24.16

0

vm-234

20

24.16

0

Finally, you might be interested in other processes associated with the Monitoring VMware virtual machine performance use case.