Virtualization Module troubleshooting

Permissions

Assign global permissions to the Splunk Add-on for VMware and the Splunk Add-on for Microsoft Hyper-V.

Learn about adding navigation to a Splunk app.

Microsoft Hyper-V performance or inventory data not being received

If your ITSI Virtualization Module is not displaying performance or inventory data from your Microsoft Hyper-V deployment, check the scripts are running.

Navigate to your Powershell log files and check for the status of the scripts on your Hyper-V server. Example: cd $SPLUNK\var\logs\splunk-powershell.ps1.log file.

Sample error of Hyper-V script not running:

"06-23-2016 11:45:00.1478947+5 ERROR User script exception: : File C:\Splunk\etc\apps\Splunk_TA_microsoft-hyperv\bin\DatastorePerfMetrics.ps1 cannot be loaded. The file C:\Splunk\etc\apps\Splunk_TA_microsoft-hyperv\bin\DatastorePerfMetrics.ps1 is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170.

This error is received when Microsoft PowerShell prevents the scripts from running if they are not digitally signed.

1. Navigate to $SPLUNK\etc\apps\Splunk_TA_microsoft-hyperv\bin\ folder and check the properties of the script files.
2. Navigate to the General tab.
3. If a message reads: Security: This file came from another computer and might be blocked to help protect this computer, click Unblock.
4. Save your changes.
5. Repeat for all the scripts in the folder.
6. Verify all the scripts files have global permissions.

Microsoft Powershell Execution can be bypassed. Use the Set-ExecutionPolicy cmdlet to set the execution policy as unrestricted. Example: PS C:\Windows\system32> Set-ExecutionPolicy Unrestricted

Change collection intervals

Adjust your deployment's data collection intervals. This reduces the load on your Data Collection Nodes (DCNs) and your vCenters, and helps avoid data gaps in your Virtualization Module KPIs.

1. Change the time interval for your host inventory job.
   1. On the instance where your scheduler is running, navigate to \etc\apps\Splunk_TA_vmware\default\.
   2. Open the ta_vmware_collection.conf file.
   3. Change hostinv_interval and hostinv_expiration from the 900 second default to a larger number (maximum 2700 seconds). Keep hostinv_interval and hostinv_expiration at the same number of seconds.
   4. Save your changes and exit.
2. Change the time interval for host performance data.
   1. On the instance where your scheduler is running, navigate to \etc\apps\Splunk_TA_vmware\local\.
   2. Open the ta_vmware_collection.conf file.
   3. Change hostvmperf_interval and hostvmperf_expiration from the 180 second default to a larger number (maximum 1200 seconds). Keep hostvmperf_interval and hostvmperf_expiration at the same number of seconds.
   4. Save your changes and exit.