Troubleshoot the VMware vSphere entity integration in ITSI
Here are some common VMware integration issues and how to resolve them.
The DCN isn't sending metrics data to Splunk
- Disable forwarding to the indexer.
- Install SA-VMWIndex-inframon and restart Splunk.
- If the DCN's
index::vmware-perf-metricshas data, then there's an issue with data forwarding. If the DCN has no data, check the error logs on the DCN and DCS.
- Make sure the ta_vmware_collection_worker_inframon input is enabled on the DCN.
- Make sure the ta_vmware_collection_scheduler_inframon input is enabled on the DCS.
The DCN isn't sending data to Splunk Cloud
- Make sure the DCN can receive metrics data by following the steps above.
- Make sure the
SplunkUniversalForwarderapp is installed on the DCN from Splunk Cloud. If you have to install it, restart Splunk.
- Make sure the Splunk Cloud indexer has
- To troubleshoot universal forwarder forwarding, index a random file on the DCN and see if the Cloud indexer receives it.
Entity discovery isn't finding VMware entities
- Make sure the indexer has
index::vmware-perf-metricsand it has data for the last 5 minutes.
- Make sure the stack has an ITSI license, which is required for VMware entity discovery.
- Make sure vsphere.* metrics are available for the monitored entity. VMware entity discovery uses the prefix
vsphere.*for metric names.
"vsphere.vm.*"metrics are used for discovery. The
"vsphere.esxihost.*"metric is used for vSphere host entities and the
"vsphere.cluster.*"metric is used for VMware cluster entities.
- Make sure there's no data lag while indexing. If there's significant data lag, increase the monitoring_window in the
[vmware_*]stanza in entity_classes.conf so the entities can be discovered, then restart Splunk.
- If you're using a custom index, make sure the sai_metrics_indexes macro is updated to include the custom index used. For more information, see Use custom metric indexes in Splunk App for Infrastructure in the Administer Splunk App for Infrastructure manual.
- Verify that entity discovery saved searches are enabled in the
[Entity Class - vmware_*]stanza in $SPLUNK_HOME/etc/apps/splunk_app_infrastructure/local/savedsearches.conf.
Entity discovery isn't finding VMware datastore entities
- Make sure the ITSI Import Objects - VMware Datastore saved search is enabled.
- If the search is enabled, manually run the search to see if it returns data.
- If the search doesn't return data, make sure
index::vmware-perf-metricshas data for the last 15 mins.
- If you're using a custom index, make sure the itsi_entity_type_vmware_datastore_metrics_indexes macro is updated to include the custom index.
Entities appear in SAI but not in ITSI
Make sure the SAI entity integration in enabled. Entity discovery occurs in SAI and entities are sent to ITSI through the message bus. For more information, see Integrate the Splunk App for Infrastructure with ITSI.
About the VMware vSphere entity integration in ITSI
About the Splunk Infrastructure Monitoring entity integration in ITSI
This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.6.0 Cloud only, 4.6.1 Cloud only, 4.6.2 Cloud only, 4.7.0, 4.7.1, 4.7.2, 4.8.0 Cloud only, 4.8.1 Cloud only, 4.9.0, 4.9.1, 4.9.2, 4.9.3, 4.10.0 Cloud only, 4.10.1 Cloud only, 4.10.2 Cloud only