Troubleshoot the VMware vSphere entity integration in ITSI

Here are some common VMware integration issues and how to resolve them.

The DCN isn't sending metrics data to Splunk

1. Disable forwarding to the indexer.
2. Install SA-VMWIndex-inframon and restart Splunk.
3. If the DCN's index::vmware-perf-metrics has data, then there's an issue with data forwarding. If the DCN has no data, check the error logs on the DCN and DCS.
4. Make sure the ta_vmware_collection_worker_inframon input is enabled on the DCN.
5. Make sure the ta_vmware_collection_scheduler_inframon input is enabled on the DCS.

The DCN isn't sending data to Splunk Cloud Platform

1. Make sure the DCN can receive metrics data by following the steps above.
2. Make sure the SplunkUniversalForwarder app is installed on the DCN from Splunk Cloud Platform. If you have to install it, restart Splunk.
3. Make sure the Splunk Cloud Platform indexer has index::vmware-perf-metrics.
4. To troubleshoot universal forwarder forwarding, index a random file on the DCN and see if the Cloud indexer receives it.

Entity discovery isn't finding VMware entities

• Make sure the indexer has index::vmware-perf-metrics and it has data for the last 5 minutes.
• Make sure the stack has an ITSI license, which is required for VMware entity discovery.
• Make sure vsphere.* metrics are available for the monitored entity. VMware entity discovery uses the prefix vsphere.* for metric names. "vsphere.vm.*" metrics are used for discovery. The "vsphere.esxihost.*" metric is used for vSphere host entities and the "vsphere.cluster.*" metric is used for VMware cluster entities.
• Make sure there's no data lag while indexing. If there's significant data lag, increase the monitoring_window in the [vmware_*] stanza in entity_classes.conf so the entities can be discovered, then restart Splunk.
• If you're using a custom index, make sure the sai_metrics_indexes macro is updated to include the custom index used. For more information, see Use custom metric indexes in Splunk App for Infrastructure in the Splunk App for Infrastructure Administer Splunk App for Infrastructure manual.
• Verify that entity discovery saved searches are enabled in the [Entity Class - vmware_*] stanza in $SPLUNK_HOME/etc/apps/splunk_app_infrastructure/local/savedsearches.conf.

Entity discovery isn't finding VMware datastore entities

1. Make sure the ITSI Import Objects - VMware Datastore saved search is enabled.
2. If the search is enabled, manually run the search to see if it returns data.
3. If the search doesn't return data, make sure index::vmware-perf-metrics has data for the last 15 mins.
4. If you're using a custom index, make sure the itsi_entity_type_vmware_datastore_metrics_indexes macro is updated to include the custom index.

Entities appear in SAI but not in ITSI

Make sure the SAI entity integration in enabled. Entity discovery occurs in SAI and entities are sent to ITSI through the message bus. For more information, see Integrate the Splunk App for Infrastructure with ITSI.