Last week I've installed Splunk and Splunk App for VMware, everything looks to work fine but to details which are driving me mad.
I installed Splunk 6.2 and Splunk App for VMware 3.1.2. Indexer and DSC in the same machine, DCN in other machine using the ova provided in the App package. I have not installed any forwarder in the only vCenter that is monitorized. Now my question, does anybody know why gauges/clocks graph in the dashboard are always showing 0%? And, I don't know if it's related or not, but I think so. There's no entity info such like CPU or memory assigned to a VM or a Host. Where is this information gathered?
PD: Isn't there a bugtrack or so for Splunk and apps??!!
Something like that I am facing as well. The difference is that I see "no data" mark on the graph. I believe that your problem has to do with thresholds (if it still exists since your post is a bit old). Any opinion or answer will be appreciated.
0% is not a bad things means you are in good shape; assuming you are not getting the no data error. You may need to adjust thresholds if you want to see issues sooner.
The App Health dashboard is a good place to look.
There is also a hidden dashboard that will help with health.
Thanks, but i have another problem is that the host system detail dashboard and the virtual machine detail dashboard don't work. Any help please ?
Unfortunately I did not find a solution yet. It's a pity though, since this feature is really important for me. I am sure it is a configuration problem.
I'm facing the same issue, has anyone found a solution?
I tried adjusting the threshholds but nothing shows up
I also noticed that not all indexes that were created are beeing populated with data:
vmware-esxilog --> populated with esxi logs from the hosts and the vms
vmware-inv --> populated by api calls
vmware-perf --> populated by api calls
vmware-taskevent --> populated by api calls
vmware-vclog --> No logs showing (optional for VCenter logs I suppose)
vmware --> NO logs showing
summary_vmware --> NO logs showing
I'm seeing this same issue but i'm running splunk 6.3 with splunk app 3.2.2. any help would be greatly appreciated.
I see results not found for most of my data points? In addition, if i go to the search page I'm not seeing any data being ingested. i'm thinking I have to deploy the universal forwarder on the vcenter server but that's currently installed on pointing to a windows splunk instance. but i'm not sure if i need that since I have deployed the DCN and that's polling as well.