All Apps and Add-ons

Splunk App for VMWare: No Data in Dashboards.

ranald
Engager

Hi community,

I deployed the VMWare app on my lab environment according to the documentation and the YouTube video, or at least I tried to, but it seems that I made a mistake somewhere.

My setup includes a Search Head, an indexer, one DCN, one vsphere server (v6.0) with three esxi hosts, and a total of 46 VMs. I try to collect esxi and vsphere log data, which works fine, and API data.

On the home dashboard, the panels "Virtual Machine Health", "Host System Health" and Recent VMware Alarms are only returning No Data or No results found. While I do get quite some data of the type vmware:inv* (e.g. 500 events of sourcetype vmware:inv:vm in 24 hours) there are only five entries with sourcetype vmware:perf* and none of the other api sourcetypes.

In the Collection Configuration screen, the DCN shows up as green. The VCenter Credential Validation is also okay.

In the lab environment I also use the Splunk App for NetApp Data ONTAP, but two different DCNs. Is it possible that these two are interfering with each other?

Thanks in advance

0 Karma

trapti_splunk
Splunk Employee
Splunk Employee

Can you check configurations of your DCN machine?
- Number of CPU cores defined
- Number of worker processes enabled on scheduler.

Also try accessing this link:
[https://ipaddress:port/en-US/app/splunk_for_vmware/hydra_framework_status ]

0 Karma

saurabhkunte
Path Finder

Hello,
Did you get a resolution for this issue ?

I have the same issue where none of the Dashboards related to Perf data show anything. We recently upgraded to version 3.2.1

Please let me know. Thank you.

0 Karma

ranald
Engager

Hi,
in my case it was a embarrasing time syncronisation error between the indexer and the DCN.

0 Karma

ranald
Engager

The DCN uses 4 cores and 3 worker processes are running.

do you mean the port for the webinterface or the management port?

0 Karma

trapti_splunk
Splunk Employee
Splunk Employee

Yes, the port for web interface (8000)

0 Karma

ranald
Engager

I am not able to access the link. Firefox answers with an ssl_error_rx_record_too_long error and Chrome with an ERR_SSL_PROTOCOL_ERROR.

0 Karma

trapti_splunk
Splunk Employee
Splunk Employee

Hi Renald, then as per suggested by kserra you can create a support case.

0 Karma

trapti_splunk
Splunk Employee
Splunk Employee

Are you still facing this issue?

0 Karma

ranald
Engager

Yes. I tried some other stuff like moving the whole setup into a different virtual environment but this didn't help either.
I think i will follow kserra's suggestion and open up a support case.

0 Karma

kserra_splunk
Splunk Employee
Splunk Employee

The splunk app for netapp is made to work with the vmware app (they share some dashboard information). As long as your DCNs are separate you should be ok.

I would check the following:
Were the default credentials for the DCN altered?
http://docs.splunk.com/Documentation/VMW/3.2.1/Configuration/Createadatacollectionnode

Was the splunk_vmware_admin user role updated
http://docs.splunk.com/Documentation/VMW/3.2.1/Installation/ConfigureuserrolesfortheSplunkAppforVMwa...

It sounds like the DCN is not polling data and that is probably the source of your issues. If the above suggestions don't help then please open up a support case.

0 Karma

ranald
Engager

Thank you for your response!
The credentials for the DCN are altered and the vmware roles were asigned, so the problem seems to be somewhere else.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!