did you ever get an answer to this or figure this out? ... View more

Thank you this worked! ... View more

so after /vcacalog/... I should have 3 dots? ... View more

so I'm struggling with the REGEX, mind helping here as we're very weak in it. Do you mind messing with this, we're looking to make the profile_api our sourcetype... https://regex101.com/r/GYYFmL/5 ... View more

Another question, what does sourcetype::AIDX The AIDX mean? ... View more

Another question, what does sourcetype::AIDX The AIDX mean? ... View more

I forgot to state that these files sit on a rsyslog server (with a forwarder installed) and we ingest them in via inputs.conf. Will the props and transforms need to be on my indexers? I appreciate your response. ... View more

Yeah you have to create the local directory and then override the values We did end up increasing the time out value here as well. Try #1 first to see what happens. Use the dashboard I mentioned above, it's a big help. ... View more

I ended up doubling mine to get all the data to work in. Also go into your dashboards under Search and Reporting...you'll have a Hydra Framework dashboard there...it's pretty helpful. ... View more

Try increasing the time out value (towards the bottom of this page) https://docs.splunk.com/Documentation/VMW/3.3.2/Installation/TroubleshoottheSplunkAppforVMware Problem Incomplete or no data coming from vCenters that are properly configured and connected to by a DCN. Data collection tasks are failing and/or connections between DCN and vCenter are closing before all data is transferred. This could be due to one of two issues. The collection tasks taking longer than the vCenter and app are expecting. Collection intervals are currently overloading your Data Collection Nodes (DCNs) and your vCenters. Resolution Change collection intervals in order to reduce the load on your Data Collection Nodes (DCNs) and your vCenters Change the time interval for your host inventory job. On the instance where your scheduler is running, navigate to \etc\apps\Splunk_TA_vmware\default. Open the ta_vmware_collection.conf file. Change hostinv_interval and hostinv_expiration from the 900 second default to a larger number (maximum 2700 seconds). Keep hostinv_interval and hostinv_expiration at the same number of seconds. Save your changes and exit. Change the time interval for host performance data. On the instance where your scheduler is running, navigate to \etc\apps\Splunk_TA_vmware\local. Open the ta_vmware_collection.conf file. Change hostvmperf_interval and hostvmperf_expiration from the 180 second default to a larger number (maximum 1200 seconds). Keep hostvmperf_interval and hostvmperf_expiration at the same number of seconds. Save your changes and exit. ... View more

Couple of things that you'll need to make sure of is all of your add-ons are installed on the indexers/search heads. In addition make sure the account you're logging into has the right role tied to it. https://docs.splunk.com/Documentation/VMW/3.3.2/Installation/ConfigureuserrolesfortheSplunkAppforVMware ... View more

We're still getting errors...we have a case opened with Splunk. We upgraded to 3.3.1 and still are getting errors. I'll keep this thread updated. ... View more

so I let the nmon just run overnight hoping a nmon process would spawn...I'm now getting this error: the APP directory could not be defined, is TA-nmon / PA-nmon installed ? ... View more

I created my own nmon.conf file specifically for 12 servers: root@dply1.splunk (Linux) $ more nmon.conf # nmon.conf # This configuration file will set the interval and snapshot values when starting up the nmon binary # It is being sourced by the nmon_helper.sh script during script startup # *** FILE ENCODING: UTF-8 ! *** # When creating a local/nmon.conf, pay attention to file encoding specially when working under Windows. # The file must be UTF-8 encoded or you may run in trouble. ### NMON COLLECT OPTIONS ### # The nmon_helper.sh input script is set by default to run every 60 seconds # If Nmon is not running, the script will start Nmon using the configuration above # The default mode for Nmon data generation is set to "longperiod_low" which is the most preservative mode to limit the CPU usage due the Nmon/Splunk processing steps # Feel free to test available modes or custom mode to set better options that answer your needs and requirements # The "longperiod_high" mode is a good compromise between accuracy, CPU / licensing cost and operational intelligence, and should relevant for very large deploym ent in Production environments # Available modes for proposal below: # shortperiod_low) # interval="60" # snapshot="10" # shortperiod_middle) # interval="30" # snapshot="20" # shortperiod_high) # interval="20" # snapshot="30" # longperiod_low) # interval="240" # snapshot="120" # longperiod_middle) # interval="120" # snapshot="120" # longperiod_high) # interval="60" # snapshot="120" # Benchmarking of January 2015 with Version 1.5.0 shows that: # longperiod_middle --> CPU usage starts to notably increase after 4 hours of Nmon runtime # custom --> Set a custom interval and snapshot value, if unset short default values will be used (see custom_interval and custom_snapshot) # Default is longperiod_high mode="custom" # Refresh interval in seconds, Nmon will use this value to refresh data each X seconds # UNUSED IF NOT SET TO custom MODE custom_interval="180" # Number of Data refresh occurrences, Nmon will refresh data X times # UNUSED IF NOT SET TO custom MODE custom_snapshot="360" ### VARIOUS COMMON OPTIONS ### # Time in seconds of margin before running a new iteration of Nmon process to prevent data gaps between 2 iterations of Nmon # the nmon_helper.sh script will spawn a new Nmon process when the age in seconds of the current process gets higher than this value # The endtime is evaluated the following way: # endtime=$(( ${interval} * ${snapshot} - ${endtime_margin} )) # When the endtime gets higher than the endtime_margin, a new Nmon process will be spawned # default value to 240 seconds which will start a new process 4 minutes before the current process ends # Setting this value to "0" will totally disable this feature endtime_margin="240" ### NFS OPTIONS ### # Change to "1" to activate NFS V2 / V3 (option -N) for AIX hosts AIX_NFS23="0" # Change to "1" to activate NFS V4 (option -NN) for AIX hosts AIX_NFS4="0" # Change to "1" to activate NFS V2 / V3 / V4 (option -N) for Linux hosts # Note: Some versions of Nmon introduced a bug that makes Nmon to core when activating NFS, ensure your version is not outdated Linux_NFS="0" ### LINUX OPTIONS ### # Change the priority applied while looking at nmon binary # by default, the nmon_helper.sh script will use any nmon binary found in PATH # Set to "1" to give the priority to embedded nmon binaries # Note: Since release 1.6.07, priority is given by default to embedded binaries Linux_embedded_nmon_priority="1" # Change the limit for processes and disks capture of nmon for Linux # In default configuration, nmon will capture most of the process table by capturing main consuming processes # This function is percentage limit of CPU time, with a default limit of 0.01 # Changing this value can influence the volume of data to be generated, and the associated CPU overhead for that data to be parsed # Possible values are: # Linux_unlimited_capture="0" --> Default nmon behavior, capture main processes (no -I option) # Linux_unlimited_capture="-1" --> Set the capture mode to unlimited (-I -1) # Linux_unlimited_capture="x.xx" --> Set the percentage limit to a custom value, ex: "0.01" will set "-I 0.01" Linux_unlimited_capture="0" # Set the maximum number of devices collected by Nmon, default is set to 1500 devices # This option will be ignored if you set the Linux_unlimited_capturation below. # Increase this value if you have systems with more devices # Up to 3000 devices will be taken in charge by the Application (hard limit in nmon2csv.py / nmon2csv.pl) Linux_devices="1500" ### SOLARIS OPTIONS ### # Change to "1" to activate VxVM volumes IO statistics Solaris_VxVM="0" # UARG collection (new in Version 1.11), Change to "0" to deactivate, "1" to activate (default is activate) Solaris_UARG="1" ### AIX COMMON OPTIONS ### # Change this line if you add or remove common options for AIX, do not change NFS options here (see NFS options) # the -p option is mandatory as it is used at launch time to save instance pid AIX_options="-f -T -A -d -K -L -M -P -^ -p" Hopefully this looks ok ... View more

ok after looking through everything I see a series of these errors: 11-23-2016 10:28:26.439 -0800 INFO TailReader - Archive file='/opt/splunkforwarder/var/log/nmon/var/nmon_repository/wasacpt01_161123_0854.nmon' has stopped changing, will read it now. It doesn't look like it ever stops changing... 11-23-2016 10:29:17.774 -0800 INFO TailReader - Archive file='/opt/splunkforwarder/var/log/nmon/var/nmon_repository/wasacpt01_161123_0854.nmon' updated less than 10000ms ago, will not read it until it stops changing. File size=716204 It never processes the data...any suggestions? ... View more

Thank you this worked! ... View more