Splunk® Supporting Add-on for VMware

Deploy and use the Splunk Supporting Add-on for VMware

Acrobat logo Download manual as PDF


On January 11, 2023, the Splunk Supporting Add-on for VMware will reach its end of life and Splunk will no longer maintain or develop this product.
Acrobat logo Download topic as PDF

Troubleshoot the Splunk Supporting Add-on for VMware

Here are some common issues in the Splunk Supporting Add-on for VMware and how to resolve them.

Error message: Orphaned scheduled searches

Problem

You receive the message:

Splunk has found 3 orphaned searches owned by 1 unique disabled users. Click to view the orphaned scheduled searches. Reassign them to a valid user to re-enable or alternatively disable the searches.

On the dashboards, the dropdowns are not getting populated and It shows a warning related to empty FullHierarchy lookup.

Cause

The admin user has been renamed and Splunk no longer detects an "admin" user.

In the Splunk Supporting Add-on for VMware, the admin user is the owner of scheduled saved searches. If Splunk cannot identify a user named "admin," then these saved searches would not be scheduled and don't run. This results in empty lookups, such as the FullHierarchy lookup.

The dashboards affected get dropdown data from the FullHiearchy lookup, which is why they don't populate.

Resolution

On the search head machine, you can create a new user with the name "admin" and assign the roles admin to this user.

Virtual Machine Snapshots dashboard is not getting populated with the data collected by Splunk Add-on for VMware Metrics

Problem

The Virtual Machine Snapshots dashboard isn't populated with data.

Cause

The dashboard uses the summarized data present in the VMwareInventory data model, for which data model acceleration must be enabled. The dashboard might not get populated if data model acceleration isn't enabled.

Solution

Enable data model acceleration for the VMwareInventory data model. An admin can enable acceleration or change the acceleration period by performing the following steps on the search head:

  1. On the Splunk menu bar, click Settings > Data models.
  2. Select Splunk Supporting Add-on for VMware from the App dropdown to see the data models defined and used by the app.
  3. From the list for data models, click Edit in the Action column of a data model.
  4. Select Edit Acceleration.
  5. Check the Accelerate checkbox to enable data model acceleration.
  6. Select the summary range to specify the acceleration period. The default summary range is one month.
  7. Click Save.
Last modified on 11 January, 2021
PREVIOUS
Dashboard reference for the Splunk Supporting Add-on for VMware
  NEXT
Release Notes for the Splunk Supporting Add-on for VMware

This documentation applies to the following versions of Splunk® Supporting Add-on for VMware: 1.0.0, 1.0.1


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters