Splunk_TA_vmware Warning Message

[dharveynswccd]

Hi, in my newly stood up Splunk Enterprise environment I'm getting the following message pop-up my search head: [Unable to initialize modular input "ta_vmware_collection_worker" defined inside the app "Splunk_TA_vmware": Introspecting scheme=ta_vmware_collection_worker: script running failed (exited with code 1).]

How can I resolve this issue?

[pmakwana_splunk]

Hi @dharveynswccd,

Root Cause:
This error would generally come if SA-VMNetAppUtils and SA-Hydra are not installed on any of the Instance (SH, Indexers, Schedular, DCN) where we have installed Splunk_TA_vmware. It happens because in Splunk_TA_vmware we have added the ta_vmware_collection_worker inputs in the inputs.conf and to run this inputs the related codes are available in SA-VMNetAppUtils and SA-Hydra addons, now if those addons are not installed then the initialization would fail.

Resolution:
1) Install SA-VMNetAppUtils and SA-Hydra addons on all the instances where Splunk_TA_vmware is installed
2) Remove the Splunk_TA_vmware/default/inputs.conf and Splunk_TA_vmware/README/inputs.conf.spec file from the Splunk_TA_vmware where the SA-VMNetAppUtils and SA-Hydra addons are not installed.

You can also refer the installation docs for the VMware Addon for details:
http://docs.splunk.com/Documentation/AddOns/latest/VMW/Install

Hope it resolves your issue. Let me know if the issue still occurs.

Thanks,
Pratik