Hello,
VMWare deployment respecting Splunk deployment matrix will generate error messages in indexers splunkd.log
The deployment of the Splunk add-ons for VMWare generate error messages in splunkd.log due to shared objects from the SA-Hydra and SA-VMNetAppUtils.
The deployment matrix provided by Splunk requests only the deployment of the "Splunk_TA_vmware" on the indexers:
http://docs.splunk.com/Documentation/AddOns/released/VMW/Installationoverview
However, if both the SA-Hydra and SA-VMNetAppUtils are NOT deployed on the indexers where the Splunk_TA_vmware is deployed, the following message appears in splunkd:
11-13-2017 10:57:14.208 +0000 ERROR ModularInputs - Introspecting scheme=ta_vmware_collection_worker: script running failed (exited with code 1).
11-13-2017 10:57:14.208 +0000 ERROR ModularInputs - Unable to initialize modular input "ta_vmware_collection_worker" defined inside the app "Splunk_TA_vmware": Introspecting scheme=ta_vmware_collection_worker: script running failed (exited with code 1).
Only the deployment of the SAs will fix this situation, OR renaming / deleting the " Splunk_TA_vmware/default/inputs.conf" and "Splunk_TA_vmware/README/ inputs.conf.spec"
Since Splunk is not requesting the deployment of the Support Add-ons, either the deployment matrix must be fixed, either the packages themselves must be fixed such that deploying the Splunk_TA_vmware alone does create this error by default.
STEPS TO REPRODUCE:
Many thanks,
I'd like to mention that the latest documentation also requests to install this TA on the search head cluster - http://docs.splunk.com/Documentation/AddOns/released/VMW/Install
From the install guide:
Upload the Splunk Add-on for VMware to your search heads
Stop your Splunk platform instance.
If using a search head cluster, upload SA-Hydra, SA-VMNetAppUtils, Splunk_TA_esxilogs, Splunk_TA_vcenter, and Splunk_TA_vmware to opt/splunk/etc/shcluster/apps/ on the deployer.
In SHC this also produces numerous errors regarding the inability to initialize the modular input. Removal of the inputs.conf and inputs.conf.spec solves this as well.
You would be best off asking this same question in the "Comments" section of that documentation page. The docs team ROCKS and will get you a better answer and usually more quickly than we can do here.
Hello, thanks for your answer.
Well I don't necessary say that this is a documentation issue, which is why I am asking the question actually.
This could be as well something to improve from the Splunk_TA_vmware.