Useful Saved Searches
Use these searches to help troubleshoot problems with network connectivity.
- Edit the search and save it as a report, a dashboard panel, an alert, or an event type.
- Edit the description and the permissions for the search.
- Schedule the search.
- Add the search to a dashboard.
Useful saved search description
|vProb errors in logs||sourcetype="vmware:*log*" error "vProb*"||Detects network problems with storage devices.|
|vmfs volume locked||sourcetype="vmware:*log*" vmfs volume locked||Detects if a volume is locked by another host.|
|vCenter starts||`VcLogSourcetypes` "Starting * VirtualCenter"||Detects if there are problems starting the vCenter server.|
|All paths are dead||sourcetype="vmware:*log*" "APD"||Detects if a storage device was removed from an ESX/i host in an uncontrolled manner.|
|SCSI reservation error-i/o failed||sourcetype="vmware:*log*" "SCSI reservation error - i/o failed"||Detects the virtual machines experiencing I/O failures due to too many SCSI reservation conflicts.|
|Lost Connectivity||sourcetype="vmware:*log*" "Lost connectivity"||Detects loss of connectivity between vSphere and a device.|
|Duplicate IPs||sourcetype=vmware:esx*:* "duplicate IP"||Detects if duplicate IP addresses exists in the VMware ESX/i logs.|
This documentation applies to the following versions of Splunk® App for VMware: 3.4.1, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.7, 4.0.0, 4.0.1, 4.0.3