All Apps and Add-ons

Getting this error on my Splunk for VMware "Lookup table 'FullHierarchy' is empty."

dbradley1
Engager

I'm working on getting my VMware up and running in splunk, and I'm finally getting some data, but now i have this error showing up at the top of the screen. Any ideas where to start troubleshooting this at?

Lookup table 'FullHierarchy' is empty.

Any help would be great.

Tags (1)
0 Karma
1 Solution

abhide_splunk
Splunk Employee
Splunk Employee

If you have installed this just now, it will take around an hour to get this lookup table populated. To ensure that all is healthy for this to be working in an hour check on the following:

  1. Ensure you have added the splunk_vmware_admin user role to your admin user in Splunk
  2. Search for the following sourcetypes to ensure you have recently indexed data: "vmware:inv:hierarchy", "vmware:perf*", no need to define index as the user role will take care of that.

If these two criteria are met then you should be fine.

View solution in original post

zdrazil
New Member

The lookup is updated by saved search. Its name is "UpdateFullHierarchyAndEntity " and it is stored in app "SA-VMW-HierarchyInventory".  You can run it manually to fill up the lookup and than you can change schedule. Its schedule is  */15 * * * *.  It means it will be run every 15minutes (XX:00, XX:15,XX:30,XX:45). These minutes are usually busy minutes and the saved search could be skipped. I think that better shedule will by something like 2-47/15 * * * * (XX:02, XX:17,XX:32,XX:47).

0 Karma

abhide_splunk
Splunk Employee
Splunk Employee

If you have installed this just now, it will take around an hour to get this lookup table populated. To ensure that all is healthy for this to be working in an hour check on the following:

  1. Ensure you have added the splunk_vmware_admin user role to your admin user in Splunk
  2. Search for the following sourcetypes to ensure you have recently indexed data: "vmware:inv:hierarchy", "vmware:perf*", no need to define index as the user role will take care of that.

If these two criteria are met then you should be fine.

jbrocks
Communicator

I am having the same problem as described above. Point 1 and 2 are both correct in my setup. Does anyone have further suggestions?

0 Karma

rodspower
Explorer

Me too!! Does anybody solved this issue??

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...