VMotion events for a specific virtual machine

Data required

• VMware. This procedure depends on data primarily obtained from the Splunk Add-on for VMware Metrics; however, log and event data from the VMWare environment can also provide additional insights into general VMWare environment health. Therefore, for best performance, you should also download and install Splunk Add-on for VMware ESXi Logs and Splunk Add-on for vCenter Logs.

Procedure

1. Ensure that you have installed the IT Essentials Work app to onboard VMware data and provide the various VMware entity type configurations and dashboards.
2. Ensure that you are collecting VMware data through one or more Data Collection Nodes, which are essentially Splunk heavy forwarders with specific VMware collection configurations.
3. Run the following search. You can optimize it by specifying an index and adjusting the time range.

index=vmware-taskevent sourcetype="vmware_inframon:events" eventClass="VmMigratedEvent" vm.name="<VM_NAME>"
| stats count BY vm.name, eventClass, createdTime, sourceHost.name, host.name, sourceDatastore.datastore.moid, ds.datastore.moid, _time
| rename vm.name AS "VM" eventClass AS "Event Type" createdTime AS "Completed Time" host.name AS "Dest. ESXi" sourceHost.name AS "Src ESXi" sourceDatastore.datastore.moid AS "Src Datastore" ds.datastore.moid AS "Dest.Datastore" 
| fields - count

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Next steps

Provide this data to application teams so they can correlate VMWare activity with application performance and behavior.

You might be interested in other processes associated with the Monitoring VMware virtualization infrastructure use case.