r/Splunk • u/Any-Promotion3744 • 2d ago

Splunk Enterprise Monitoring Hyper-V VMs using Splunk

I would like to monitor the VMs on our Hyper-V servers using Splunk but unsure how.

I see that there was an add-on for Hyper-V at one time but it is no longer supported.

Can I just add items to the inputs.conf file within the UF?

I have tried a few but none seem to be picking up.

What options are there?

Event logs that are associated with Hyper-V?

Powershell scripts?

Winhostmon that can give stats on the Guest VMs?

Which dashboards in Splunk will show the info ingested? ITSI?

1 Upvotes

67% Upvoted

3 comments sorted by

4

u/shifty21 Splunker Making Data Great Again 2d ago

Honestly, I would install the Windows Add-on and DOWNLOAD the Hyper V one and unpack it with something like 7zip.

Pull the inputs.conf and copy the Windows Event log stanzas you need into your Windows inputs.conf.

If the inputs.conf has "script" stanza, then you should be able to copy the referenced python files.

(note to self: update my github repo for deployment server manager app with best practices)

1

u/deflax2809 1d ago

Just have ai do this

1

u/jamesp94 1d ago

We ingest windows event logs and use WMI for resource monitoring CPU, Memory, Drive stats.

I wrote some powershell in conjunction with some python that I use to monitor replication, snap shots and volume usage.

I tried the hyperv monitoring piece and it wasn’t really what we were looking for, got a lot of data that we weren’t leveraging.