Splunk® IT Essentials Work

Entity Integrations Manual

This documentation does not apply to the most recent version of Splunk® IT Essentials Work. For documentation on the most recent version, go to the latest release.

Troubleshoot the VMware vSphere entity integration in ITE Work

Here are some common VMware integration issues and how to resolve them.

The DCN isn't sending metrics data to Splunk

  1. Disable forwarding to the indexer.
  2. Install SA-VMWIndex-inframon and restart Splunk.
  3. If the DCN's index::vmware-perf-metrics has data, then there's an issue with data forwarding. If the DCN has no data, check the error logs on the DCN and DCS.
  4. Make sure the ta_vmware_collection_worker_inframon input is enabled on the DCN.
  5. Make sure the ta_vmware_collection_scheduler_inframon input is enabled on the DCS.

The DCN isn't sending data to Splunk Cloud Platform

  1. Make sure the DCN can receive metrics data by following the steps above.
  2. Make sure the SplunkUniversalForwarder app is installed on the DCN from Splunk Cloud Platform. If you have to install it, restart Splunk.
  3. Make sure the Splunk Cloud Platform indexer has index::vmware-perf-metrics.
  4. To troubleshoot universal forwarder forwarding, index a random file on the DCN and see if the Cloud indexer receives it.

Entity discovery isn't finding VMware entities

  • Make sure the indexer has index::vmware-perf-metrics and it has data for the last 5 minutes.
  • Make sure vsphere.* metrics are available for the monitored entity. VMware entity discovery uses the prefix vsphere.* for metric names. "vsphere.vm.*" metrics are used for discovery. The "vsphere.esxihost.*" metric is used for vSphere host entities and the "vsphere.cluster.*" metric is used for VMware cluster entities.
  • Make sure there's no data lag while indexing. If there's significant data lag, increase the monitoring_window in the [ITSI Import Objects - VMWare *] stanza in $SPLUNK_HOME/etc/apps/itsi/local/savedsearches.conf so the entities can be discovered, then restart Splunk.
  • If you're using a custom index, make sure the itsi_im_metrics_indexes macro is updated to include the custom index used. For more information, see Use custom indexes in ITE Work.
  • Verify that entity discovery saved searches are enabled in the [ITSI Import Objects - VMWare *] stanza in $SPLUNK_HOME/etc/apps/itsi/local/savedsearches.conf.

Entity discovery isn't finding VMware datastore entities

  1. Make sure the ITSI Import Objects - VMware Datastore saved search is enabled.
  2. If the search is enabled, manually run the search to see if it returns data.
  3. If the search doesn't return data, make sure index::vmware-perf-metrics has data for the last 15 mins.
  4. If you're using a custom index, make sure the itsi_entity_type_vmware_datastore_metrics_indexes macro is updated to include the custom index.
Last modified on 29 July, 2022
About the VMware vSphere entity integration in ITE Work   About the Splunk Infrastructure Monitoring entity integration in ITE Work

This documentation applies to the following versions of Splunk® IT Essentials Work: 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only, 4.15.0, 4.15.1, 4.15.2, 4.15.3


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters