Integrate Splunk with Commander

Combining third-party guest OS performance data with VM performance metrics from the hypervisor allows Commander to provide more accurate rightsizing recommendations for your virtualized infrastructure—without burdening the Commander system with intensive data storage and data processing requirements.

You can configure Commander to obtain Windows guest OS performance data for your virtualized infrastructure from Splunk, a data collection and analysis tool. Commander retrieves third-party performance data whenever performance data is updated (either manually or as part of the nightly performance update). Commander then combines Windows Guest OS and VM performance information before generating recommendations.

The source of the performance data is included in the rightsizing recommendation. As shown in the image below, VM performance data appears first, followed by Guest OS performance data. Note that because the hypervisor (such as VMware) and Splunk use different metrics, VM performance data, and Guest OS performance data values may differ.

After integrate Splunk to retrieve guest OS performance data, you can optimize the Update VM Performance query with Splunk to optimize the process when performance data is being requested from the Splunk server. See Optimize the VM Performance Query with Splunk.

Create system credentials for the Splunk server

Commander supports Splunk version 6 or higher, with the HTTPS protocol.

1. On the Credentials page, click Add.
2. Enter the user name and password for a Splunk account.
3. For the description, enter "Splunk", to serve as a memory aid to administrators when configuring tasks requiring credentials.
4. From Category, select System Credentials.
5. Click OK.

Connect Commander to a Splunk server

To get performance data from Splunk, you must connect Commander to a Splunk server.

1. Click the Integration tab.
2. On the Integration page, select Add > Splunk Server.
3. Enter the host name or IP address and the port number for the Splunk server. The default port is 8089.
4. From Credentials, choose the Splunk credentials.
5. To optimize the Splunk query, enable Accelerate Searches

   You must configure saved searches in Splunk to make use of this feature. Also note that if Splunk is misconfigured, Commander won't be able to retrieve performance data from Splunk until the configuration is corrected.

6. Click Test to test the connection to Splunk.
7. Once the test has succeeded, click OK to save the configuration.

Once you have successfully integrated Commander with a Splunk server, if Commander is unable to connect to the Splunk server (for example, if the Splunk server is down), a status message is displayed in the Splunk Server pane.

Disable or remove the Splunk server

Disabling an external server makes the server unavailable for connections but saves the settings, meaning that you can return to the configuration dialog later and re-enable it.

Removing an external server clears the settings, meaning that you must reconfigure all of the settings if you want to reintegrate later.

To disable an external server:

1. Click the Integration tab.
2. On the Integration page, select the server you want to disable, and click Edit.
3. Clear the Enabled checkbox, and click OK.

To remove an external server:

1. Click the Integration tab.
2. On the Integration page, select the server you want to remove, and click Remove.
3. Click Yes to confirm the change.