Skip to main content
Splunk Lantern の記事が日本語で利用できるようになりました。.
Splunk Lantern

VMware datastores with highest utilization


Datastores hold critical files needed for normal VMware operation. Like any other storage container, running out of space is bad. You want to see all the datastores in your environment according to the least percentage of free space remaining.

Data required


  1. Ensure that you have installed the IT Essentials Work app to onboard VMware data and provide the various VMware entity type configurations and dashboards.
  2. Ensure that you are collecting VMware data through one or more Data Collection Nodes, which are essentially Splunk heavy forwarders with specific VMware collection configurations.
  3. Run the following search. You can optimize it by specifying an index and adjusting the time range.
| mstats latest(vsphere.datastore.used_percent) WHERE (index=vmware-perf-metrics) span=1m BY name, moid, pool_name, unit, vcenter
| eval used_percent=round('latest(vsphere.datastore.used_percent)',2)
| timechart latest(used_percent) BY name

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation
| mstats latest(vsphere.datastore.used_percent) WHERE (index=vmware-perf-metrics) span=1m BY name, moid, pool_name, unit, vcenter Search metrics index(es) where VMWare datastore metrics are collected and split by the field shown.
| eval used_percent=round('latest(vsphere.datastore.used_percent)',2) Create a new field named used_percent and round the value to two decimals for readability.
| timechart latest(used_percent) BY name Plot the datastore usage over time.

Next steps

A potential next step is to correlate this data with asset identification data such as department, business usage, criticality, and similar attributes to further help with identification of opportunities for optimization and planning. This can be done with a lookup using the datastore ID or the url as the key into the lookup.

To alert when average datastore utilization is nearing max capacity, you can configure one of the following two recommendations:

  • Use the SPL from this procedure to configure a Splunk platform alert.
  • Configure the average datastore usage vital metric for the VMware Datastore entity type in IT Essentials Work to alert when the VMware datastore utilization percentage is at or near 100.

Finally, you might be interested in other processes associated with the Monitoring VMware virtual machine performance use case.