Splunk® IT Service Intelligence

Modules

Acrobat logo Download manual as PDF


Splunk IT Service Intelligence (ITSI) version 4.11.x reached its End of Life on December 6, 2023. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see Before you upgrade IT Service Intelligence.
Acrobat logo Download topic as PDF

Virtualization Module troubleshooting

Permissions

Assign global permissions to the Splunk Add-on for VMware and the Splunk Add-on for Microsoft Hyper-V.

Learn about adding navigation to a Splunk app.

Microsoft Hyper-V performance or inventory data not being received

If your ITSI Virtualization Module is not displaying performance or inventory data from your Microsoft Hyper-V deployment, check the scripts are running.

Navigate to your Powershell log files and check for the status of the scripts on your Hyper-V server. Example: cd $SPLUNK\var\logs\splunk-powershell.ps1.log file.

Sample error of Hyper-V script not running:

"06-23-2016 11:45:00.1478947+5 ERROR User script exception: : File C:\Splunk\etc\apps\Splunk_TA_microsoft-hyperv\bin\DatastorePerfMetrics.ps1 cannot be loaded. The file C:\Splunk\etc\apps\Splunk_TA_microsoft-hyperv\bin\DatastorePerfMetrics.ps1 is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170.

This error is received when Microsoft PowerShell prevents the scripts from running if they are not digitally signed.

  1. Navigate to $SPLUNK\etc\apps\Splunk_TA_microsoft-hyperv\bin\ folder and check the properties of the script files.
  2. Navigate to the General tab.
  3. If a message reads: Security: This file came from another computer and might be blocked to help protect this computer, click Unblock.
  4. Save your changes.
  5. Repeat for all the scripts in the folder.
  6. Verify all the scripts files have global permissions.

Microsoft Powershell Execution can be bypassed. Use the Set-ExecutionPolicy cmdlet to set the execution policy as unrestricted. Example: PS C:\Windows\system32> Set-ExecutionPolicy Unrestricted

Change collection intervals

Adjust your deployment's data collection intervals. This reduces the load on your Data Collection Nodes (DCNs) and your vCenters, and helps avoid data gaps in your Virtualization Module KPIs.

  1. Change the time interval for your host inventory job.
    1. On the instance where your scheduler is running, navigate to \etc\apps\Splunk_TA_vmware\default\.
    2. Open the ta_vmware_collection.conf file.
    3. Change hostinv_interval and hostinv_expiration from the 900 second default to a larger number (maximum 2700 seconds). Keep hostinv_interval and hostinv_expiration at the same number of seconds.
    4. Save your changes and exit.
  2. Change the time interval for host performance data.
    1. On the instance where your scheduler is running, navigate to \etc\apps\Splunk_TA_vmware\local\.
    2. Open the ta_vmware_collection.conf file.
    3. Change hostvmperf_interval and hostvmperf_expiration from the 180 second default to a larger number (maximum 1200 seconds). Keep hostvmperf_interval and hostvmperf_expiration at the same number of seconds.
    4. Save your changes and exit.
Last modified on 28 April, 2023
PREVIOUS
Virtualization Module data model reference table
  NEXT
About the Web Server Module

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.5, 4.11.6, 4.12.0 Cloud only, 4.12.1 Cloud only, 4.12.2 Cloud only, 4.13.0, 4.13.1, 4.13.2, 4.13.3, 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only, 4.15.0, 4.15.1, 4.15.2, 4.15.3, 4.16.0 Cloud only, 4.17.0, 4.17.1, 4.18.0, 4.18.1


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters