Getting Data In

Splunk VMWare Addon - No Hydra Workers

ifeldshteyn
Communicator

I've installed a VM Ware OVA DCN. I successfully hooked it up to Vcenter and got a list of 30+ hosts. However, anytime I try to get any data I keep getting errors "Attempted to assign jobs but we have no active workers to assign to. Restarting Scheduler..."

Looked at the raw hydra coda it seems like I am getting an empty node manifest and zero nodes are available. I am def missing something here.

I assume the procedure is

  1. install VM Ware add on OVA. (Complete)
  2. Hook it up VCenter (Complete)
  3. Forward data to Splunk (Complete - I tested adding log files on the OVA install, they successfully fwd data to Splunk).

But for some reason Hydra refuses to find any workers.

As an aside, is there perhaps an easier way to forward ESXI node data to Splunk? Something more trivial than these OVA add-ons ?

Thanks!

0 Karma

myriadic
Path Finder

in the vmware addon you have a scheduler, which you hook up to vmware (which you did), then DCNs, or data collection nodes, which do the actual pulling of data. this can be the same box that's a scheduler (just point to localhost) or another splunk HF. have you assigned any boxes to be a DCN, yet?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Meet the .conf26 AI Agent Buildathon Winners

At the .conf26 AI Agent Buildathon, Splunk users turned their operational expertise into working AI agents ...

Trusted Autonomy in the SOC: A Maturity Journey

AI is compressing attacker timelines and pushing SOC teams beyond human capacity thresholds. The next SOC ...

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...