I think it's because hardware.sh is called by both vmware.sh and vmware_metric.sh, and hardware.sh has an rm $TMP_ERROR_FILTER_FILE statement just below the grep statement (where the error is generated.) If you are running both vmware.sh and vmware_metric.sh at the same periodicity (for example 60 seconds), it's a race condition when both scripts invoke hardware.sh which has an "rm", which would remove the file before the second script get to that line of execution (the grep).  If you look at your error log, the error is logged against vmware.sh or vmware_metric.sh, but not both.  I ran into this issue, and I added a few seconds offset, for example, run vmware.sh at 60 seconds interval and vmware_metric.sh at 65 seconds interval, to eliminate the race condition. ... View more

To resolve the "not URL encoded" error, modify your $SPLUNK_HOME/etc/apps/Splunk_TA_emc-vnx/default/tags.conf and change all ":" (colon) to "%3A" -- %3A is the URL encoded representation for the colon. Until Splunk fixes the aggressive error checking, this will shut up the annoying error. In vim edit mode: :%s/:/\%3A/g To resolve the "No data collection for VNX is found in the inputs.conf. Do nothing and Quit the TA" error, you need to modify your $SPLUNK_HOME/etc/apps/Splunk_TA_emc-vnx/local/inputs.conf to specify the IP address and user credential needed to read your EMC VNX. It looks like this: [vnx_data_loader://EMC_GUID] network_addr = x.y.z.zz username = plaintextusername password = plaintextpassword platform = VNX Block or File ... View more