Troubleshoot the Splunk Add-on for Cisco UCS

For helpful troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in Splunk Add-ons. For additional resources, see Support and resource links for add-ons in Splunk Add-ons.

Configure logging level

The Splunk Add-on for Cisco UCS allows you to configure logging levels in the configuration UI under the logging tab or in splunk_ta_cisco_ucs_settings.conf. Allowed log levels are DEBUG, INFO, WARN, and ERROR. The default is INFO. To configure logging using the UI, perform the following steps:

1. Go to Splunk Web on your data collection node.
2. Access the Splunk Add-on for Cisco UCS UI.
3. Click Configuration > Logging, then select a logging level from the drop-down menu.

Search for configuration errors

If you do not see the data you expect when you search for sourcetype=cisco:ucs:*, inspect the event types for relevant errors.

1. If you have data collection errors, search for eventype="cisco_ucs_ta_log_error" OR eventtype="ta_util_error".
2. If you have web configuration errors, search for eventtype="cisco_ucs_ta_web_error".
3. If you see "reached maximum session limit" in an eventtype=cisco_ucs_ta_log_error, go to your Cisco UCS manager to set a bigger session limit. See Chapter: Managing Administrative Settings in the Cisco UCS Central CLI Reference Manual for details.