Integrating Splunk with Commander

Combining third-party guest OS performance data with VM performance metrics from the hypervisor allows Commander to provide more accurate rightsizing recommendations for your virtualized infrastructure—without burdening the Commander system with intensive data storage and data processing requirements.

You can configure Commander to obtain Windows guest OS performance data for your virtualized infrastructure from Splunk, a data collection and analysis tool. Commander retrieves third-party performance data whenever performance data is updated (either manually or as part of the nightly performance update). Commander then combines Windows Guest OS and VM performance information before generating recommendations.

The source of the performance data is included in the rightsizing recommendation. As shown in the image below, VM performance data appears first, followed by Guest OS performance data. Note that because the hypervisor (such as VMware) and Splunk use different metrics, VM performance data, and Guest OS performance data values may differ.

Tip: After integrate Splunk to retrieve guest OS performance data, you can optimize the Update VM Performance query with Splunk to optimize the process when performance data is being requested from the Splunk server. See Optimizing the VM Performance Query with Splunk.

Create system credentials for the Splunk server

Access through:

Configuration > Credentials

Available to:

Commander Role of Superuser and Enterprise Admin

Note: Commander supports Splunk version 6 or higher, with the HTTPS protocol.

To create a set of credentials for Splunk:

  1. On the Credentials page, click Add.
  2. Enter the user name and password for a Splunk account.
  3. For the description, enter "Splunk", to serve as a memory aid to administrators when configuring tasks requiring credentials.
  4. From Category, choose System Credentials.
  5. Click OK.

Connect Commander to a Splunk server

Access through:

Configuration > System > Integration tab

Available to:

Commander Role of Superuser

To get performance data from Splunk:

  1. On the Integration page, click Add > Splunk Server.
  2. Enter the host name or IP address and the port number for the Splunk server. The default port is 8089.
  3. From Credentials, choose the Splunk credentials.
  4. To optimize the Splunk query, enable Accelerate Searches

    Note: You must configure saved searches in Splunk to make use of this feature. Also note that if Splunk is misconfigured, Commander won't be able to retrieve performance data from Splunk until the configuration is corrected.

  5. Click Test to test the connection to Splunk.
  6. Once the test has succeeded, click OK to save the configuration.

Note: Once you have successfully integrated Commander with a Splunk server, if Commander is unable to connect to the Splunk server (for example, if the Splunk server is down), a status message is displayed in the Splunk Server pane.

Disabling or removing the Splunk server

Disabling an external server makes the server unavailable for connections but saves the settings, meaning that you can return to the configuration dialog later and simply re-enable it.

Removing an external server clears the settings, meaning that you must reconfigure all of the settings if you want to reintegrate later.

Access through:

Configuration > System > Integration tab

Available to:

Commander Role of Superuser

To disable an external server:

  1. On the Integration page, select the server you want to disable, and click Edit.
  2. Clear the Enabled checkbox, and click OK.

To remove an external server:

  1. On the Integration page, select the server you want to remove, and click Remove.
  2. Click Yes to confirm the change.