Getting this error on my Splunk for VMware "Lookup table 'FullHierarchy' is empty."

[dbradley1]

I'm working on getting my VMware up and running in splunk, and I'm finally getting some data, but now i have this error showing up at the top of the screen. Any ideas where to start troubleshooting this at?

Lookup table 'FullHierarchy' is empty.

Any help would be great.

[zdrazil]

The lookup is updated by saved search. Its name is "UpdateFullHierarchyAndEntity " and it is stored in app "SA-VMW-HierarchyInventory".  You can run it manually to fill up the lookup and than you can change schedule. Its schedule is  */15 * * * *.  It means it will be run every 15minutes (XX:00, XX:15,XX:30,XX:45). These minutes are usually busy minutes and the saved search could be skipped. I think that better shedule will by something like 2-47/15 * * * * (XX:02, XX:17,XX:32,XX:47).

[abhide_splunk · Accepted solution]

If you have installed this just now, it will take around an hour to get this lookup table populated. To ensure that all is healthy for this to be working in an hour check on the following:

1. Ensure you have added the splunk_vmware_admin user role to your admin user in Splunk
2. Search for the following sourcetypes to ensure you have recently indexed data: "vmware:inv:hierarchy", "vmware:perf*", no need to define index as the user role will take care of that.

If these two criteria are met then you should be fine.

[jbrocks]

I am having the same problem as described above. Point 1 and 2 are both correct in my setup. Does anyone have further suggestions?

[rodspower]

Me too!! Does anybody solved this issue??