Hi, I'm trying to get logs from our vCenter Server 6.0 into our VMware App. It looks like the TA is using the log structure from the old vCenter 5.x and not the 6.x. Like described here: https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1021804 5.x and 6.x have very different log approaches it seems. Looking at the props.conf in the Splunk_TA_vcenter, it seems like it is only working for 5.x and not 6.x. Am I missing a new TA? What am I doing wrong? The VMware app says it supports vCenter Server 6.x. I'm getting the logs into Splunk when monitoring the directory, but fields won't get properly extracted. ... View more

I am trying to set up the Splunk App for VMware I installed the DCN from the .ova, installed the VMware app on my indexer/search head. Credentials are correct, green ticks everywhere. But when I run the scheduler, I get error messages from the hydraworker: ERROR [ta_vmware_collection_scheduler://puff] [HydraWorkerNode] Incorrect number of heads=3 on node=https://XXX:8089, actual_heads=2, trying to bring number up to correct value The value for actual_heads is sometimes different (0, 1, or 2) No matter what value I set at "worker processes" for the DCN, I always get these errors and no data is coming in at all. Do you have any idea what could cause this problem? Is number of heads the number of CPU cores allocated to the virtual machine DCN? ... View more

Is there a way to track down users who made changes to reports or saved searches? Maybe even with the information what exactly was changed in the search? ... View more

We run into some issues in our Splunk environment. We have a Splunk 6.3 indexer and search head. The dispatch directory on the search head is constantly growing and Splunk stops working after a few days. We then need to manually restart the search head. After the restart, the dispatch directory is getting cleaned up automatically and only searches from the last 24h remain. I already set the dispatch.ttl in savedsearches.conf to 86400. (1 day) But the artifacts in the directory remain for much longer until we restart the system. We have about 10 scheduled searches with alarms which run every hour, so it is not that much. Is there any way to fix the automatic clean-up of the directory or what is the best way to restart the search head automatically every night on a Windows system? ... View more