Configure the modular input for the Splunk Add-on for EMC VNX

The Splunk Add-on for EMC VNX uses a modular input for data collection. Copy default/inputs.conf to local/inputs.conf and edit appropriately.

Important: Configuration of data collection through Splunk's Data Inputs page is not supported at this time. Only direct edit of the local/inputs.conf is supported.

1. Enter a unique stanza name describing the input, such as sf_vnx01_inventory.

  [vnx_data_loader://<unique name>]

2. Enter the IP addresses for the Primary Control Station (or storage processor A). If there is a Standby or storage processor B, enter its address in the second field.

  network_addr = <value>
  network_addr2 = <value>

3. Enter the credentials of the read-only service account. The add-on encrypts the usernames and passwords recorded in local/inputs.conf when it first runs. After encryption, these fields show as <encrypted>.

   username = <value>
   password = <value>

4. Enter the platform of the VNX device being queried ("VNX File" or "VNX Block").

   platform = <value>

Note: The platform value is case-sensitive.

5. Enter the scope (0, 1, or 2) of the VNX Block device.

  scope = <value>

Note: Scope will only be used for VNX Block device.

6. Optionally, enter a short site identifier such as SF.

   site = <value>

7. Enter the desired loglevel ("INFO", "DEBUG", "WARN" or "ERROR").

   loglevel = <value>

8. Enter the desired index for this stanza's data (Defaults to "dmc").

   index = <value>

9. Enable the stanza by setting disabled to "false", or disable the stanza by setting disabled to "true".

   disabled = <value>

Repeat until a stanza has been created for each VNX device to be queried for data. For example:

   [vnx_data_loader://sf_vnx_file]
   network_addr = 10.185.11.254
   network_addr2 = 10.185.11.255
   username = dummy
   password = dummy_pass
   platform = VNX File
   site = SF

   [vnx_data_loader://sf_vnx_block]
   network_addr = 10.185.11.252
   network_addr2 = 10.185.11.253
   username = dummy
   password = dummy_pass
   platform = VNX Block
   scope = 0
   site = SF

After configuring local/inputs.conf, restart splunkd. Verify that credentials are encrypted and that data is being gathered into the expected index(es). Adding and removing stanzas requires restarting splunkd.

To update an existing stanza's credentials, you must update username and password at the same time. If only one is updated, the encryption process will not work properly and the stanza will no longer be valid. Replace <encrypted> in the username and password fields with plaintext values and restart splunkd.