All Apps and Add-ons

Getting this error on my Splunk for VMware "Lookup table 'FullHierarchy' is empty."

dbradley1
Engager

I'm working on getting my VMware up and running in splunk, and I'm finally getting some data, but now i have this error showing up at the top of the screen. Any ideas where to start troubleshooting this at?

Lookup table 'FullHierarchy' is empty.

Any help would be great.

Tags (1)
0 Karma
1 Solution

abhide_splunk
Splunk Employee
Splunk Employee

If you have installed this just now, it will take around an hour to get this lookup table populated. To ensure that all is healthy for this to be working in an hour check on the following:

  1. Ensure you have added the splunk_vmware_admin user role to your admin user in Splunk
  2. Search for the following sourcetypes to ensure you have recently indexed data: "vmware:inv:hierarchy", "vmware:perf*", no need to define index as the user role will take care of that.

If these two criteria are met then you should be fine.

View solution in original post

zdrazil
New Member

The lookup is updated by saved search. Its name is "UpdateFullHierarchyAndEntity " and it is stored in app "SA-VMW-HierarchyInventory".  You can run it manually to fill up the lookup and than you can change schedule. Its schedule is  */15 * * * *.  It means it will be run every 15minutes (XX:00, XX:15,XX:30,XX:45). These minutes are usually busy minutes and the saved search could be skipped. I think that better shedule will by something like 2-47/15 * * * * (XX:02, XX:17,XX:32,XX:47).

0 Karma

abhide_splunk
Splunk Employee
Splunk Employee

If you have installed this just now, it will take around an hour to get this lookup table populated. To ensure that all is healthy for this to be working in an hour check on the following:

  1. Ensure you have added the splunk_vmware_admin user role to your admin user in Splunk
  2. Search for the following sourcetypes to ensure you have recently indexed data: "vmware:inv:hierarchy", "vmware:perf*", no need to define index as the user role will take care of that.

If these two criteria are met then you should be fine.

jbrocks
Communicator

I am having the same problem as described above. Point 1 and 2 are both correct in my setup. Does anyone have further suggestions?

0 Karma

rodspower
Explorer

Me too!! Does anybody solved this issue??

0 Karma
Get Updates on the Splunk Community!

Splunk Certification Support Alert | Pearson VUE Outage

Splunk Certification holders and candidates!  Please be advised of an upcoming system maintenance period for ...

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...