In Veeam One Reporter, how do I determine if I have enough hardware resources in my vSphere cluster to add additional CPU to a specific VM?

You would use Veeam One Reporter, to take the Guesswork out of Resource Optimization and Planning.

Can you detail the steps I need to take in Veeam ONE?

I have a few questions.

Would I start off here?

If so, for this particular ESX host that the VM reside on, it shows the following for Capacity planning:

The VM that I need to provision currently has 8 CPUs. I need to configure it to have a total of 12 CPUs (Total number of cores). With the report provided, does it look like I have enough capacity to add additional CPUs?

Also, To provision a total of 12 CPUs for this VM, would I add on to "Number of virtual sockets" or "Number of cores per socket"?

I would always recommend you use sockets, rather than cores, only use cores if you have a specific licensing restriction based on cores.

So I would change the exiting setup to 8 vCPUs (sockets) x 1 Core.

Yes, I think you have capacity.

12 vCPU that is a lot of processing, very few VMs need more than 4 vCPU!

What is the function of this server, and remember, adding many vCPU can cause te performance to get worse!

This is a Splunk Indexer server, which will require more resources to accommodate all the manual and background queries that are constantly occurring.

Check performance of the virtual machine, CPU, Memory and Disk!

This Splunk VM is an Indexer. Here is the guest's individual resource usage statistics

Here is a one week performance stat of CPU and memory.

In checking Resource Monitor, I am seeing a bunch of "splunkd.exe" process running at once, thus spiking up the CPU to 99% - 100%. Should there be more than one "splunkd.exe" running at once? Would restarting the service resolve this problem?

Also, would be helpful if someone can forward me a data sheet that detail the minimum hardware requirement for a Splunk Indexer VM.

datastore ?

How many messages are hitting the server ?

Very quickly, you do not have enough ram, minimum should be 12GB, and nearer 16GB.

see here

http://docs.splunk.com/Documentation/Splunk/6.1/Installation/Systemrequirements

The Splunk documentation makes many recommendations, but they are generic. It's likely that it will use as much RAM as you are willing to give it, but you would have to do experiments to determine if the extra RAM actually helps. Is your environment willing to accommodate some A/B testing where you may see whether increasing RAM or increasing the number of vCPUs makes a difference for the users' perceived performance? Those investigations can be done relatively easily and don't necessarily require that you know a lot about the application's behavior. Remember that adding vCPUs makes the VM harder to schedule, so - depending on what else is going on on the host - may not help performance.

For testing, you can afford to be somewhat bold: increase RAM allocation by 50-100%. Increase the number of vCPU to 50% of what the host has available. If you can see a difference with large changes, you can do more changes to see if you can find the optimal level. If you can't see a difference with such large changes,  you'll need to look elsewhere for performance bottlenecks.

If these experiments don't help, you'll need to do more detailed performance analysis. Splunk is going to also depend on network performance and storage access. It would prefer to have dedicated devices for some of its storage and in some cases using SSD in the right place will make a big difference.

Andrew,

Thanks for the link. I think I can forward this to upper management to justify why we would need to bump up the CPU and RAM. I have a couple of questions based on the below screenshot.

1. Does "2x six-core" mean 12 CPU?

2. If so, based on Splunk Indexer Server VM Properties, how would i configure what I currently have for CPUs to meet the requirement of 12 CPU?

1. The splunk requirement is based on a physical server specification.

2. if you want to set the server to 12 vCPU, you must stop the server, and change 2 to 12, and 4 to 1.

I would change as a test from 2 to 8, and 4 to 1.

e.g. 8 vCPU, if 8 CPUs are really required in the VM.

Only got a slight improvement after upgrading the RAM to 12 GB and CPU to 12 CPU on the VM. Should I be looking into I/O next? Here are a couple of screenshot concerning disk below. Can anyone tell me if disk utilization appears abnormal? If so, what action(s) should I take next to increase the performace?

you need to look at read and write latencies.

see my EE Article here, look at disk i/o bottlenecks

HOW TO:  Performance Monitor vSphere 4.x or 5.0

and you may find that this VM, is not suitable as a virtual machine!