{"id":2491,"date":"2026-10-29T10:32:06","date_gmt":"2026-10-29T09:32:06","guid":{"rendered":"https:\/\/thomas-kopton.de\/vblog\/?p=2491"},"modified":"2026-10-29T10:40:27","modified_gmt":"2026-10-29T09:40:27","slug":"vcf-operations-super-metrics-part-3-filtering-logic","status":"publish","type":"post","link":"https:\/\/thomas-kopton.de\/vblog\/?p=2491","title":{"rendered":"VMware VCF Operations Super Metrics from 0 to Hero \u2013 Part 3: Filtering and Logic"},"content":{"rendered":"\n

At the end of Part 2<\/a> I left you with a flawed formula. Our vCPU to pCore ratio summed the vCPUs of every<\/mark><\/em> VM in the cluster, including the ones that have been powered off for months. A customer looking at that number would see an overcommitment that doesn\u2019t exist.<\/p>\n\n\n\n

So far, a resource entry has used every object it found. In this part we get picky: only powered-on VMs, only fresh data, only VMs above a threshold. And we turn numbers into states that alerts and dashboards can act on.<\/p>\n\n\n\n

The WHERE clause<\/h3>\n\n\n\n

The where<\/code> clause sits inside<\/mark><\/strong> the resource entry and is evaluated per object, before aggregation<\/mark><\/strong>. An object that doesn\u2019t pass is simply ignored.<\/p>\n\n\n\n

The simplest form filters on the value itself. $value<\/code> is the metric the resource entry reads:<\/p>\n\n\n\n

count(${adaptertype=VMWARE, objecttype=VirtualMachine, metric=cpu|usage_average, depth=2, where=($value > 80)})<\/code><\/pre>\n\n\n\n
Assigned to a cluster, this counts the VMs running above 80% CPU. Combined with count, the where clause becomes one of the most useful tools we have.<\/p>\n\n\n\n
Filtering on a different metric<\/h3>\n\n\n\n
Often, the condition is about a different metric of the same object. For that, you put a resource entry inside<\/mark><\/em> the where<\/code> clause, with only a metric and no adaptertype or objecttype:<\/p>\n\n\n\n
where=(${metric=sys|poweredOn} == 1)<\/code><\/p>\n\n\n\n
This reads sys|poweredOn<\/code> of the very VM being evaluated. And that fixes the ratio from Part 2:<\/p>\n\n\n\n
sum(${adaptertype=VMWARE, objecttype=VirtualMachine, metric=config|hardware|num_Cpu, depth=2, where=(${metric=sys|poweredOn} == 1)}) \/ sum(${adaptertype=VMWARE, objecttype=HostSystem, metric=hardware|cpuinfo|num_CpuCores, depth=1})<\/code><\/pre>\n\n\n\n
Put both versions side by side on the same cluster. The difference is the vCPU allocated to powered-off VMs, which is a good conversation starter on its own.<\/p>\n\n\n\n
Conditions can be combined with &&<\/code> (and), ||<\/code> (or) and !<\/code> (not), and compared with ==<\/code>, !=<\/code>, <<\/code>, <=<\/code>, > and >=<\/code>. Here is a rightsizing view in a single number, the idle VMs that are actually running:<\/p>\n\n\n\n
count(${adaptertype=VMWARE, objecttype=VirtualMachine, metric=cpu|usage_average, depth=2, where=($value < 5 && ${metric=sys|poweredOn} == 1)})<\/code><\/pre>\n\n\n\n
Without the second condition, every powered-off VM would count as idle, too.<\/p>\n\n\n\n
\"\"<\/a>
Figure 01: Super Metric with a filtering function.<\/em><\/figcaption><\/figure>\n\n\n\n
Don\u2019t trust stale data: isFresh()<\/h3>\n\n\n\n
Here is a subtle one. When a host or VM stops reporting, its last value doesn\u2019t disappear. Without precautions, that frozen number keeps flowing into your average or sum.<\/p>\n\n\n\n
The isFresh()<\/code> function protects against that. It returns true when the last data point of a metric is newer than the metric\u2019s expected publishing interval:<\/p>\n\n\n\n
avg(${adaptertype=VMWARE, objecttype=HostSystem, metric=cpu|usage_average, depth=1, where=($value.isFresh())})<\/code><\/pre>\n\n\n\n
It combines with other conditions like any other expression:<\/p>\n\n\n\n
where=($value < 5 && $value.isFresh() && ${metric=sys|poweredOn} == 1)<\/code><\/p>\n\n\n\n
I add isFresh()<\/code> to most aggregating KPIs that feed alerts or dashboards. A KPI that silently reports yesterday\u2019s value is worse than one that reports nothing.<\/p>\n\n\n\n
Matching on text<\/h3>\n\n\n\n
The where<\/code> clause also understands string operators for string metrics and properties: equals<\/code>, contains<\/code>, startsWith<\/code>, endsWith<\/code> and their negations. For example, counting Linux VMs in a cluster:<\/p>\n\n\n\n
count(${adaptertype=VMWARE, objecttype=VirtualMachine, metric=sys|poweredOn, depth=2, where=\"summary|guest|fullName contains Linux\"})<\/code><\/pre>\n\n\n\n
Property keys can differ between versions, so pick the guest OS key with autocomplete and confirm the result with Preview. A word of advice: if your filter describes a business scope (all SAP VMs, all VMs of tenant X), a custom group is usually the cleaner solution. More on that in Part 4.<\/p>\n\n\n\n
For another real-world filtering example, see my earlier post Exclude \u201cAggregate\u201d Instanced Metric using vRealize Operations Super Metric<\/a>.<\/p>\n\n\n\n
Turning numbers into decisions: conditional expressions<\/h3>\n\n\n\n
The ternary operator is an if-else in one line: condition ? value_if_true : value_if_false<\/code>. Ternaries can contain any expression, including other ternaries. That makes them perfect for status codes:<\/p>\n\n\n\n
Name: YourPrefix - Cluster Host CPU Status<\/code> – Assigned to: Cluster Compute Resource, Unit: none<\/p>\n\n\n\n
max(${adaptertype=VMWARE, objecttype=HostSystem, metric=cpu|usage_average, depth=1}) > 80 ? 2 : (max(${adaptertype=VMWARE, objecttype=HostSystem, metric=cpu|usage_average, depth=1}) > 60 ? 1 : 0)<\/code><\/pre>\n\n\n\n
The status follows the busiest host in the cluster. Read it as: if any host is above 80% CPU usage, return 2 (critical); otherwise, if any host is above 60%, return 1 (warning); otherwise return 0 (healthy). The formula reads the host metric through a looping function, because cpu|usage_average<\/code> is a metric of the hosts, not of the cluster object. The resource entry appears twice here, in Part 4 we\u2019ll see how an alias avoids that.<\/p>\n\n\n\n
Why convert a perfectly good percentage into 0, 1 and 2? Because:<\/p>\n\n\n\n