Known issues and workarounds

The following are issues and workarounds for this version of Splunk for VMware.

• TimeHierarchyVM does not contain migration data for VM's. The TimeHierarchyVM lookup is not getting updated correctly. This causes the summary data to not be tied to the hierarchy properly, which breaks views such as VM Detail that show the performance of a VM across migrations (SOLNVMW-2186).
• Large lookups in SA-VMW-HierarchyInventory increase the size of the search knowledge bundle and have a performance impact in a search head pooling environment (SOLNVMW-2019).

We do not support search head pooling in this release. As a workaround you can remove all lookups, except for TimeHierarchyVM, TimeHierarchyHostSystem, and TimeHierarchyCluster from the bundle replication.

• In the Alarm Overview view errors are displayed and Splunk cannot retrieve data (SOLNVMW-2003).
• On the views vms_by_host and vmware_host_summary, the bottom panel, "VMs on Host" is not affected by time range and will show all VMs ever associated with the host(s) selected, even if the VM has migrated or been deleted. Changing the time range on the the views vms_by_host and vmware_host_summary has no effect on the the "VMs on Host" panel in those views. the are not filtered by selected time range in the views. (SOLNVMW-1931).
• In the Capacity Planning for Clusters - CPU Headroom view, it is possible to see different VM counts in the top left and right panels because they are driven by different data (SOLNVMW-1926).
• In performance views, the value of select metrics can change. It should stay the same. (SOLNVMW-1848).
• VMware-managed entity lists are sorted alphabetically, but do not take case into account. For example, all VMs with names starting with initial capitla letters (A-Z) appear earlier in the lists than VMs with names that start with lower-case letters (a-z) (SOLNVMW-1817).
• The Inventory data health view may show no data when a large time range and a small span is selected. For example, when you select a time range of "The last 30 days” and a span of 15 minutes, the graphs may show no data. The workaround is to use a larger span for large time ranges (SOLNVMW-1734).
• The Capacity Planning (Hosts) view does not support unmanaged hosts (SOLNVMW-1536).
• When a host is added to a new vCenter without being deleted from the vCenter where it was previously managed, the host may appear to be still on the original vCenter. The workaround is to delete the Host from the original vCenter before adding it to a new vCenter (SOLNVMW-1460).
• It is possible for frequent VM migrations not to appear in the Virtual Machine Detail and VM Migration views (SOLNVMW-1458).
• The Splunk Forwarder Virtual Appliance for VMware can take longer to boot when DHCP is not available (SOLNVMW-1200).
• License information in ESX/i Host Summary and VMs on the Host view is not populated for managed hosts (SOLNVMW-920).
• It is possible to see gaps in ESX/i log data due to VMware server log rotation, during which time log lines that haven’t been collected will be lost (SOLNVMW-860).
• Searches in Splunk Search Head in distributed search or standalone instance on Windows server will crash constantly. This applies to only Windows platform. This is due to Splunk core platform bug. (SPL-53256)