Alerting

Why is my VMWare APP not displaying any dashboard data?

dharveynswccd
Path Finder

Hi Splunkers,
Last Friday configured Splunk App for VMware, everything appears to work fine, but this morning I came back to work and the VMWare app is not working.
I am running Splunk Enterprise Version:7.2.3 and Splunk App for VMware 3.4.4. Indexers, Search Heads, Syslog Server/Forwarder, and DCN are all configured according to the Splunk documentation (this was actually configured by Splunk PS on Friday). Now the issue is that gauges/clocks graph in the dashboard are a showing 0%? And there's no entity info such like CPU or memory assigned to a VM or a Host. Splunkd is running just fine, my Syslog Server/Forwarder shows data being collected, permissions are fine, and when I perform a search on the Index I am seeing current, up-to-the-minute logs. Can anyone help figure out why the dashboard in the app is not being populated? Thanks

Tags (1)
0 Karma

michael_schmidt
Path Finder

Rebuild the data models.

0 Karma

dharveynswccd
Path Finder

Michael thanks for your input. Can you provide your reasons for this?

0 Karma

michael_schmidt
Path Finder

Because the Data Models are what delivers the data to the app. It doesn't pull logs directly for most of the graphs etc. And if the DataModels are empty, or failed to finish, or got messed up, then the app won't display any data.

Of course this is assuming that PS set everything up correctly, and that the indexing is being done properly etc.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...