Experiencing a lack of data in the Splunk app for VMware

[omershira]

Hello,

We installed the Splunk app for VMware in our environment. we followed the documentation and installed the required add-on for VMware that contains all the TA's.

We placed the TA's according to the documentation, and configured the app as it said.

Now, when we try to look at the app and use it part of the panels are empty. We checked the "app install health collected source types" and according to it we receive all the needed information, for example at the Home tab the Datastore Information is empty.

We tried to inspect and looked at the SPL code and run it from the search, we noticed some of the commands are unknown and we couldn't find any details about them, for example those commands appeared: 

- ifields

- gaugetable

We don't know where the problem is, the data dose seem to flow since we do receive a big part of it.

Is anyone experienced this issue? Any help would be great!  

Thanks,

Omershira

[kurzer]

Hi,

unfortunately I don't have an answer, but I'm interessted in one as well.

Stumbled across the same. I heard that there might be some kind of internal command starting with an 'i' like fields and ifields, but not sure if thats just rumor.