All Apps and Add-ons

Getting this error on my Splunk for VMware "Lookup table 'FullHierarchy' is empty."

dbradley1
Engager

I'm working on getting my VMware up and running in splunk, and I'm finally getting some data, but now i have this error showing up at the top of the screen. Any ideas where to start troubleshooting this at?

Lookup table 'FullHierarchy' is empty.

Any help would be great.

Tags (1)
0 Karma
1 Solution

abhide_splunk
Splunk Employee
Splunk Employee

If you have installed this just now, it will take around an hour to get this lookup table populated. To ensure that all is healthy for this to be working in an hour check on the following:

  1. Ensure you have added the splunk_vmware_admin user role to your admin user in Splunk
  2. Search for the following sourcetypes to ensure you have recently indexed data: "vmware:inv:hierarchy", "vmware:perf*", no need to define index as the user role will take care of that.

If these two criteria are met then you should be fine.

View solution in original post

zdrazil
New Member

The lookup is updated by saved search. Its name is "UpdateFullHierarchyAndEntity " and it is stored in app "SA-VMW-HierarchyInventory".  You can run it manually to fill up the lookup and than you can change schedule. Its schedule is  */15 * * * *.  It means it will be run every 15minutes (XX:00, XX:15,XX:30,XX:45). These minutes are usually busy minutes and the saved search could be skipped. I think that better shedule will by something like 2-47/15 * * * * (XX:02, XX:17,XX:32,XX:47).

0 Karma

abhide_splunk
Splunk Employee
Splunk Employee

If you have installed this just now, it will take around an hour to get this lookup table populated. To ensure that all is healthy for this to be working in an hour check on the following:

  1. Ensure you have added the splunk_vmware_admin user role to your admin user in Splunk
  2. Search for the following sourcetypes to ensure you have recently indexed data: "vmware:inv:hierarchy", "vmware:perf*", no need to define index as the user role will take care of that.

If these two criteria are met then you should be fine.

jbrocks
Communicator

I am having the same problem as described above. Point 1 and 2 are both correct in my setup. Does anyone have further suggestions?

0 Karma

rodspower
Explorer

Me too!! Does anybody solved this issue??

0 Karma
Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...