Troubleshoot the VMware vSphere entity integration in ITSI

Here are some common VMware integration issues and how to resolve them.

The DCN isn't sending metrics data to Splunk

1. Disable forwarding to the indexer.
2. Install SA-VMWIndex-inframon and restart Splunk.
3. If the DCN's index::vmware-perf-metrics has data, then there's an issue with data forwarding. If the DCN has no data, check the error logs on the DCN and DCS.
4. Make sure the ta_vmware_collection_worker_inframon input is enabled on the DCN.
5. Make sure the ta_vmware_collection_scheduler_inframon input is enabled on the DCS.

The DCN isn't sending data to Splunk Cloud Platform

1. Make sure the DCN can receive metrics data by following the steps above.
2. Make sure the SplunkUniversalForwarder app is installed on the DCN from Splunk Cloud Platform. If you have to install it, restart Splunk.
3. Make sure the Splunk Cloud Platform indexer has index::vmware-perf-metrics.
4. To troubleshoot universal forwarder forwarding, index a random file on the DCN and see if the Cloud indexer receives it.

Entity discovery isn't finding VMware entities

• Make sure the indexer has index::vmware-perf-metrics and it has data for the last 5 minutes.
• Make sure vsphere.* metrics are available for the monitored entity. VMware entity discovery uses the prefix vsphere.* for metric names. "vsphere.vm.*" metrics are used for discovery. The "vsphere.esxihost.*" metric is used for vSphere host entities and the "vsphere.cluster.*" metric is used for VMware cluster entities.
• Make sure there's no data lag while indexing. If there's significant data lag, increase the monitoring_window in the [ITSI Import Objects - VMWare *] stanza in $SPLUNK_HOME/etc/apps/itsi/local/savedsearches.conf so the entities can be discovered, then restart Splunk.
• If you're using a custom index, make sure the itsi_im_metrics_indexes macro is updated to include the custom index used. For more information, see Use custom indexes in ITSI.
• Verify that entity discovery saved searches are enabled in the [ITSI Import Objects - VMWare *] stanza in $SPLUNK_HOME/etc/apps/itsi/local/savedsearches.conf.

Entity discovery isn't finding VMware datastore entities

1. Make sure the ITSI Import Objects - VMware Datastore saved search is enabled.
2. If the search is enabled, manually run the search to see if it returns data.
3. If the search doesn't return data, make sure index::vmware-perf-metrics has data for the last 15 mins.
4. If you're using a custom index, make sure the itsi_entity_type_vmware_datastore_metrics_indexes macro is updated to include the custom index.