Troubleshoot the VMware vSphere entity integration in ITE Work
Here are some common VMware integration issues and how to resolve them.
The DCN isn't sending metrics data to Splunk
- Disable forwarding to the indexer.
- Install SA-VMWIndex-inframon and restart Splunk.
- If the DCN's
index::vmware-perf-metrics
has data, then there's an issue with data forwarding. If the DCN has no data, check the error logs on the DCN and DCS. - Make sure the ta_vmware_collection_worker_inframon input is enabled on the DCN.
- Make sure the ta_vmware_collection_scheduler_inframon input is enabled on the DCS.
The DCN isn't sending data to Splunk Cloud Platform
- Make sure the DCN can receive metrics data by following the steps above.
- Make sure the
SplunkUniversalForwarder
app is installed on the DCN from Splunk Cloud Platform. If you have to install it, restart Splunk. - Make sure the Splunk Cloud Platform indexer has
index::vmware-perf-metrics
. - To troubleshoot universal forwarder forwarding, index a random file on the DCN and see if the Cloud indexer receives it.
Entity discovery isn't finding VMware entities
- Make sure the indexer has
index::vmware-perf-metrics
and it has data for the last 5 minutes. - Make sure vsphere.* metrics are available for the monitored entity. VMware entity discovery uses the prefix
vsphere.*
for metric names."vsphere.vm.*"
metrics are used for discovery. The"vsphere.esxihost.*"
metric is used for vSphere host entities and the"vsphere.cluster.*"
metric is used for VMware cluster entities. - Make sure there's no data lag while indexing. If there's significant data lag, increase the monitoring_window in the
[ITSI Import Objects - VMWare *]
stanza in $SPLUNK_HOME/etc/apps/itsi/local/savedsearches.conf so the entities can be discovered, then restart Splunk. - If you're using a custom index, make sure the itsi_im_metrics_indexes macro is updated to include the custom index used. For more information, see Use custom indexes in ITE Work.
- Verify that entity discovery saved searches are enabled in the
[ITSI Import Objects - VMWare *]
stanza in $SPLUNK_HOME/etc/apps/itsi/local/savedsearches.conf.
Entity discovery isn't finding VMware datastore entities
- Make sure the ITSI Import Objects - VMware Datastore saved search is enabled.
- If the search is enabled, manually run the search to see if it returns data.
- If the search doesn't return data, make sure
index::vmware-perf-metrics
has data for the last 15 mins. - If you're using a custom index, make sure the itsi_entity_type_vmware_datastore_metrics_indexes macro is updated to include the custom index.
About the VMware vSphere entity integration in ITE Work | About the Splunk Infrastructure Monitoring entity integration in ITE Work |
This documentation applies to the following versions of Splunk® IT Essentials Work: 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only, 4.15.0, 4.15.1, 4.15.2, 4.15.3
Feedback submitted, thanks!