Known issues and workarounds

Known issues in Splunk for VMware 3.0

• NetApp app version 2.x where Hydra schedulers are running for NetApp app DCNs cannot be installed in the same Splunk instance where VMware app v3.0.x Hydra schedulers are running. A workaround is to install NetApp apps Hydra scheduler in a separate Splunk instance from where Splunk VMware app Hydra schedulers are running. NetApp app views/dashboards and VMware app views/dashboards, and indexers does not have this issue. (SOLNVMW-3653)
• Stopped receiving perf data for VM's due to a difference in the perf matrix counter for the VMs and hosts. (SOLNVMW-3358)
• In the Host detail page, an error and storage and task information is displayed for hosts when no host is selected. (SOLNVMW-3223)
• In certain cases inventory data gaps can be more than 4 hours. (SOLNVMW-3271)
• In certain cases, ESXi logs coming via Syslog are assigned an incorrect sourcetype. (SOLNVWM-3257).
• Some tasks on Host detail view have a blank message. (SOLNVMW-3256).
• Saved search to reset bad hosts runs with clear-existing flag. A vCenter can not successfully send syslog data to two different log hosts. (SOLNVMW-3247)
• If you configure Syslog using intermediate forwarders and loghost values are not returned, the ESXi host becomes unresponsive to the API and no error message is displayed. (SOLNVMW-3245).
• An incorrect host list is displayed when the latest host list is not retrieved from the server. (SOLNVMW-3229).
• Error when user skips configuration of collection nodes.You must configure data collection to get data into the app. (SOLNVMW-3294).
• If you select a 4 hour time range the labels display custom relative time range. (SOLNVMW-3237) (SOLNVMW-2973).
• The app has no control over resetting Syslog for hosts that are disconnected but once were connected to a vCenter. The host can still forward Syslog data. (SOLNVMW-3234).
• On IE9, the Threshold Configuration view's height grows unexpectedly as you enter text in the textbox. (SOLNVMW-3168)
• There is a known network connectivity issue where the ESXi hosts can stop sending syslog data. The splunk App for Vmware implements a workaround to this problem and runs a script (a saved search) on the indexer on a 10 minute time schedule to check for data gaps and to reset the syslog process. 

If the indexer does not get data after a period of 10 minutes has passed the script is automatically kicked off to reset syslog, so that data collection can continue. 

• In IE9 the vmware_task_event_details view does not refresh after entering text in the textbox. (SOLNVMW-3163)
• In a multi vCenter environment, a parent type node, like a cluster that has no children, will render a hover chart as if it were a leaf. (SOLNVMW-3119)
• A powered off vm can't lookup datastore information from time based lookup TimeDatastoreSummary. (SOLNVMW-3083).
• On the Proactive Monitoring > Entity views > Host system detail page, in the Host Configuration and Status panel, an incorrect result is displayed for Hyperthreading for the host. (SOLNVMW-2580)
• When you manually edit the sa_threshold.conf file the App is not updated to reflect the changes. Always update thresholds using the Configuration Thresholds page in the App. (SOLNVMW-2543)
• The VM Detail view, that show the performance of a VM across migrations, is not displayed correctly when TimeHierarchyVM does not contain migration data for the virtual machines. The TimeHierarchyVM lookup is not updated correctly which prevents the summary data from being tied to the hierarchy. (SOLNVMW-2186)
• Large lookups in SA-VMW-HierarchyInventory increase the size of the search knowledge bundle and have a performance impact in a search head pooling environment. (SOLNVMW-2019)

We do not support search head pooling in this release. As a workaround you can remove all lookups, except for TimeHierarchyVM, TimeHierarchyHostSystem, and TimeHierarchyCluster from the bundle replication.

• VMware-managed entity lists are sorted alphabetically, but do not take case into account. For example, all VMs with names starting with initial capital letters (A-Z) appear earlier in the lists than VMs with names that start with lower-case letters (a-z). (SOLNVMW-1817)
• At times, frequent VM migrations do not appear in the Virtual Machine Detail and VM Migration views. (SOLNVMW-1458)
• A license warning message "You have no license for Splunk App for VMware, Contact sales for a license" is reported once a day. (SOLNVMW-3588)