Install Splunk App for NetApp Data ONTAP

Download Splunk App for NetApp Data ONTAP, from Splunkbase and verify that the download package file name is splunk-app-for-netapp-data-ontap_<number>.tgz.

Distributed installation

Use the tables below to determine where and how to install the Splunk App for NetApp Data ONTAP in a distributed deployment of Splunk Enterprise.

Splunk instance type	Supported	Comments
Search Heads	Yes	Install this app to all search heads where NetApp knowledge management is required.
Indexers	No	Install the Splunk Add-on for NetApp Data ONTAP on indexers to monitor NetApp data output.
Forwarders	No	Install the Splunk Add-on for NetApp Data ONTAP on forwarders to monitor NetApp syslog output.

Distributed deployment compatibility

This table provides a quick reference for the compatibility of the Splunk App for NetApp ONTAP with Splunk distributed deployment features.

Distributed deployment feature	Supported	Comments
Search Head Clusters	Yes	Learn about NetApp cluster configuration.
Indexer Clusters	No	Install the Splunk Add-on for NetApp Data ONTAP onto your cluster master to deploy the Splunk Add-on for NetApp Data ONTAP packages.
Deployment Server	No	If you use a deployment server, install the Splunk Add-on for NetApp Data ONTAP onto your deployment servers.

Single instance deployment

A single-instance deployment of Splunk Enterprise contains indexers and search heads on a single host.

1. Move the splunk-app-for-netapp-data-ontap_<number>.tgz file to $SPLUNK_HOME/etc/apps.

2. Extract the app package.

tar -xvf splunk-app-for-netapp-data-ontap_<number>.tgz

3. Verify that all of the installation components exist in the $SPLUNK_HOME/etc/apps folder.

4. Restart your Splunk platform instance.

Distributed deployment

For larger environments where data originates on many machines and where many users need to search the data, you can separate out the functions of indexing and searching. In this type of distributed search deployment, each indexer indexes data and performs searches across its own indexes. A Splunk Enterprise instance dedicated to search management, called the search head, coordinates searches across the set of indexers, consolidating the results and presenting them to the user. For more information about distributed search, see About distributed search in the Distributed search manual.

In a distributed search environment:

1. Get the file splunk-app-for-netapp-data-ontap_<number>.tgz and put it in $SPLUNK_HOME/etc/apps on your search head.
2. In $SPLUNK_HOME/etc/apps extract the app package.

   tar -xvf splunk-app-for-netapp-data-ontap_<number>.tgz

3. Verify that splunk_app_netapp/… was copied correctly and resides in $SPLUNK_HOME/etc/apps:
4. Restart Splunk in each of the locations where you installed the app. For both Windows and Unix instructions, see "Start and stop Splunk" in the Splunk Admin Manual.

Search head cluster environment

Version 2.1.0 and later of the Splunk App for NetApp Data ONTAP supports search head clustering environments. Perform the steps in this topic to set up NetApp Data ONTAP in a search head cluster (SHC) deployment. This configuration improves the overall performance of the Splunk app NetApp Data ONTAP.

For an overview of search head clustering, see "Search head clustering architecture" in the Splunk Enterprise Distributed Search Manual.

Prerequisites

The Splunk App for NetApp Data ONTAP requires the following:

• A licensed version of Splunk Enterprise installed and running in your environment
• You have access to the NetApp Data ONTAP app and permission to install it.

For search head clustering, complete the following requirements:

• You need a minimum of 3 instances of Splunk Enterprise to serve as search head cluster members, and one additional instance that serves as a deployer, which you use to distribute apps and updated configurations to the cluster members.
• Each search head cluster member should be a new Splunk platform installation and not a re-purposed Splunk platform instance.
• You have migrated your settings from a search head pool to a search head cluster. For more information, see Migrate from a search head pool to a search head cluster in the "Splunk Enterprise Distributed Search Manual".
• The data collection node (DCN) scheduler must be deployed on a dedicated search head, and not on any individual search head in the SHC.

Install your Search head cluster

Search head clustering is supported by version 2.1.0 and later of the Splunk App for NetApp Data ONTAP.

See Deploy a search head cluster in the "Splunk Enterprise Distributed Search Manual" for more information on how to install, configure and deploy a search head cluster.

Install and Deploy the Splunk App for NetApp Data ONTAP in your search head cluster

Follow the steps below to download, install and deploy the Splunk App for NetApp Data ONTAP onto your search head cluster. You must use the search head cluster deployer to distribute your configurations across your set of search head cluster members. See "Use the deployer to distribute apps and configuration updates" in the Splunk Enterprise Distributed Search Manual.

1. Take the file splunk-app-for-netapp-data-ontap_<number>.tgz that you downloaded from Splunkbase and put it in a temporary directory. This avoids overriding critical files.

   cp splunk-app-for-netapp-data-ontap_<number>.tgz /tmp

2. Change to the /tmp directory, and extract the app package.

   cd /tmp

   tar -xvf splunk-app-for-netapp-data-ontap_<number>.tgz

3. Copy the unzipped files and move into your deployer's apps folder inside the shcluster folder.

   cp -r /tmp/* $SPLUNK_HOME/etc/shcluster/apps/

4. Verify that splunk_app_netapp/… was copied correctly and reside in the $SPLUNK_HOME/etc/shcluster/apps folder.
5. On your deployer, deploy the NetApp Data ONTAP app onto any member of your SHC.

   ./splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>

6. Restart Splunk in each of the locations where you installed the app. For both Windows and Unix instructions, see "Start and stop Splunk" in the Splunk Admin Manual.

   Configure user roles

   There are two default user roles defined in the Splunk Add-on for NetApp Data ONTAP and the Splunk App for NetApp Data ONTAP:

   • The splunk_ontap_admin role: This role gives you permission to configure the Splunk Add-on for NetApp Data ONTAP for data collection.
   • The splunk_ontap_user role: This role gives you permission to use the add-on. It does not give you permission to configure the add-on.

   Configure roles for the users of the add-on on the following components:

   • Scheduler (If using a separate scheduler)
   • Search head (or the combined indexer and search head)

   Assign roles to each user

   1. Log in to Splunk Web and enter the IP address and port number of the OS hosting your search head and/or scheduler:

      http://<ipaddress>:8000/

   2. Select the Splunk Add-on for NetApp Data ONTAP from the Apps menu, and navigate to the Collection Configuration page. If this is your first time installing the app, then you are automatically redirected to the Setup page. Accept all of the default settings on the Setup screen, then click Save. For most installations the default settings work.
   3. In Settings, select Users and authentication: Access controls, then select Users.
   4. Give the admin user the splunk_ontap_admin role so that the admin can run scheduled searches. Add splunk_ontap_admin to the "admin" account.
   5. Provide admin_all_objects capability to the splunk_ontap_admin role.
      1. Go to the Settings > Access controls > Roles > splunk_ontap_admin.
      2. Add admin_all_objects capability.
      3. Click Save.

   See the Splunk Add-on for NetApp Data ONTAP installation documentation for add-on installation and data collection node configuration steps.