Known issues and workarounds

The following are issues and workarounds for this version of Splunk for VMware.

• Some performance views present an incorrect representation of historical data for short time ranges. (SOLNVMW-1979)
• Reduce Perf Data Volume (SOLNVMW-1932 & SOLNVMW-1961) Due to changes we have made in the data formats the Min and Max fields are now duplicates of the Average field.
• The VM list in the ESX/i Host Summary and VMs on the Host view and the ESX/i Host Summary and VMs on the Host view are not filtered by selected time range in the views. They will contain all the VMs in the past for the host, including deleted and migrated VMs (SOLNVMW-1931).
• In the Capacity Planning for Clusters - CPU Headroom view, it is possible to see different VM counts in the top left and right panels because they are driven by different data (SOLNVMW-1926).
• Some multi-line log files may be parsed incorrectly (SOLNVMW-1900).
• The logincreator tool does not work with existing local or ActiveDirectory users (SOLNVMW-1893).
• The Object field might not be populated correctly in the ESX/i Log Browser view. It is possible to see empty Object field in the view due to complex log line formats (SOLNVMW-1892).
• Excessive log data in vpxd logs due to our code (SOLNVMW-1866). VMware api calls made by the FA VM against vCenter are responsible for writing increased amounts of log data to the vpxd logs.
• Selected metrics might change in performance views (SOLNVMW-1848).
• VMware-managed entity lists are sorted alphabetically, but not case-insensitively. For example, all VMs with names that start with capital letters first (A-Z) appear before VMs with names that start with lower-case letters (a-z) (SOLNVMW-1817).
• The Inventory data health view may show no data when a large time range and a small span is selected. For example, when you select a time range of "The last 30 days” and a span of 15 minutes, the graphs may show no data. The workaround is to use a larger span for large time ranges (SOLNVMW-1734).
• The Capacity Planning (Hosts) view does not support unmanaged hosts (SOLNVMW-1536).
• When a host is added to a new vCenter without being deleted from the vCenter where it was previously managed, the host may appear to be still on the original vCenter. The workaround is to delete the Host from the original vCenter before adding it to a new vCenter (SOLNVMW-1460).
• It is possible for frequent VM migrations not to appear in the Virtual Machine Detail and VM Migration views (SOLNVMW-1458).
• The Splunk Forwarder Virtual Appliance for VMware can take longer to boot when DHCP is not available (SOLNVMW-1200).
• License information in ESX/i Host Summary and VMs on the Host view is not populated for managed hosts (SOLNVMW-920).
• It is possible to see gaps in ESX/i log data due to VMware server log rotation, during which time log lines that haven’t been collected will be lost (SOLNVMW-860).
• Searches in Splunk Search Head in distributed search or standalone instance on Windows server will crash constantly. This applies to only Windows platform. This is due to Splunk core platform bug. (SPL-53256)