Splunk® Supported Add-ons

Splunk Add-on for NetApp Data ONTAP

Upgrade the Splunk Add-on for NetApp Data ONTAP from v3.0.1 to v3.0.4

See the following steps to upgrade the Splunk Add-on for NetApp Data ONTAP from v3.0.1 to 3.0.4:

  1. Upgrade the scheduler.
  2. Upgrade the data collection node.
  3. Upgrade the indexer.
  4. Upgrade the search head.
  5. Start Splunk and the data collection node.

These upgrade steps only apply to users upgrading from v3.0.1/v3.0.2/v3.0.3/v3.0.4 to v3.0.5 of the Splunk Add-on for NetApp Data ONTAP. If you are using a version previous to v3.0.1 (v2.1.91 or v3.0.0), upgrade to v3.0.1 first. Then, you can upgrade to v3.0.5 from v3.0.1 by following these steps.

Upgrade the scheduler

  1. Make sure the splunk_ontap_admin role has the admin_all_objects capability before upgrading the scheduler.
  2. Go to the ONTAP Collection Configuration page of the Splunk Add-on for NetApp Data ONTAP and click Stop Scheduler.
  3. Stop Splunk on the scheduler instance.
  4. Download the Splunk Add-on for NetApp Data ONTAP v3.0.4 from Splunkbase and extract its contents to the $SPLUNK_HOME/etc/apps directory. This overwrites the Splunk_TA_ontap and SA-Hydra packages.

Upgrade the data collection node

  1. Stop Splunk on the data collection node machine.
  2. Download the Splunk Add-on for NetApp Data ONTAP v3.0.4 from Splunkbase and extract its contents to the $SPLUNK_HOME/etc/apps directory. This overwrites the previously installed add-on packages.

Upgrade the indexer

  1. Enable maintenance mode on the cluster master node.
  2. Download the Splunk Add-on for NetApp Data ONTAP Indexes v3.0.4 from Splunkbase and extract the SA-ONTAPIndex package to the /apps folder for your deployment.
    • For a non-indexer cluster deployment, extract to $SPLUNK_HOME/etc/apps.
    • For the indexer-clustering deployments, extract to $SPLUNK_HOME/etc/master-apps.
    • For indexer-clustering deployments, push the configuration bundle from the cluster master node.
  3. Disable maintenance mode on the cluster master node.

Upgrade the search head

  1. Stop Splunk on the machine.
  2. Download the Splunk Add-on for NetApp Data ONTAP Extractions v3.0.4 from Splunkbase and extract the TA-ONTAP-FieldExtractions package to the /apps directory for your deployment.
    • For non-search head cluster deployments, extract to $SPLUNK_HOME/etc/apps.
    • For search head clustering deployments, extract to $SPLUNK_HOME/etc/shcluster/apps/.
  3. If you aren't using knowledge objects explicitly from the SA-VMNetAppUtils directory, remove the SA-VMNetAppUtils directory from the apps folder as the add-on doesn't use any KOs from this package. Keep the package as is, if you are using any of the knowledge objects from this package.
  4. The Hydra troubleshooting dashboards (Hydra Framework Status and Hydra Scheduler Status) have been added to the TA-ONTAP-FieldExtractions package. So, you can remove the SA-Hydra directory from the Search head, if present.
  5. For search head clustering deployments, push the app bundle from the deployer. The deployer restarts all the search head cluster members after the upgrade is applied. fIf the deployer doesn't restart the search head cluster members, perform a rolling restart.

Start Splunk and the data collection node

  1. Start Splunk on the data collection node machine.
  2. Start Splunk on the scheduler machine.
  3. Navigate to the Collection Configuration page of the Splunk Add-on for NetApp Data ONTAP on the scheduler tier.
  4. Click Start Scheduler to start data collection.
Last modified on 13 September, 2023
Upgrade the Splunk Add-on for NetApp Data ONTAP from v3.0.1 or later to v3.1.0  

This documentation applies to the following versions of Splunk® Supported Add-ons: released


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters