Configure inputs for the Splunk Add-on for Cisco UCS

Configure your inputs on your data collection node, which is usually a heavy forwarder. You can configure your inputs using either the Splunk Web UI or configuration files.

Set SSL details

SSL details must be configured in configuration files.

• To collect data from a Cisco UCS Manager without SSL certificate verification, set the manager's disable_ssl_verification to true in your splunk_ta_cisco_ucs_servers.conf file. Find it at $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-ucs/local/splunk_ta_cisco_ucs_servers.conf.

• To collect data from a Cisco UCS Manager using an SSL connection with a self-signed certificate, add the certificate's value in your cacerts.pem file. It is at $SPLUNK_HOME/etc/apps/Splunk_TA_Cisco_ucs/lib/certifi/.

Collecting data from a Cisco UCS Manager using an SSL connection with a signed Trusted Certificate requires no additional steps.

Splunk Web configuration instructions

Use the Splunk Web UI to configure Cisco UCS Managers, Templates, and Inputs.

Configure Cisco UCS Managers

To configure a Cisco UCS Manager, perform the following steps:

1. By default, the Splunk Add-on for Cisco UCS page starts on the Manage Cisco UCS Managers screen. If you are on a different screen, select Configurations > Managers to reach this screen.
2. Click Add.
3. In the Add Cisco UCS Manager window, complete the following fields.

Field	Description
Name	Give your manager a name using only letters, numbers, and underscores.
Description	Optionally, enter a description for the Cisco UCS Manager.
Host	Provide the host or IP address of your Cisco UCS Manager.
Username	If your Cisco UCS Manager requires authentication, enter a valid username.
Password	If your Cisco UCS Manager requires authentication, enter a valid password.

4. Click Add.
5. Repeat these steps for each Cisco UCS Manager from which you want to collect data.

Return to this screen if you want to edit, create, or delete your existing Manager configurations.

Configure Cisco UCS Templates

To configure Cisco UCS Templates, perform the following steps:

1. Select Configuration > Templates.
2. Review the predefined collection templates by selecting Edit next to each template. If these templates meet your needs, you can use them as is. You can also edit them by deleting or adding metrics.
3. If you want to make your own template, click Add.
4. In the Add a Collection Template window, complete the following fields:

   Field	Description
   Name	Give your template a name using letters, numbers, and underscores.
   Description	Optionally, give your template a brief description to distinguish it from other templates.
   Metrics	Click in the metrics field to browse or search for the Cisco UCS classIDs that you want to collect data from.

5. Click Add.

You can include any number of metrics in a single template, but for best results, limit the number of metrics that you include in a single template to avoid overloading the Cisco UCS Manager. Limit your performance metrics to no more than 15 within one template. Inventory metrics, which are static and less frequently collected, can be in larger groups. Conversely, avoid creating many individual templates with just one or very few metrics to avoid overloading the Cisco UCS Manager with too many concurrent sessions.

For more information on the Cisco UCS classIDs, refer to the Cisco UCS Central CLI Reference Manual.

Return to this screen if you want to edit, create, or delete your existing templates.

Configure Cisco UCS Inputs

To configure Cisco UCS Inputs, perform the following steps:

1. Select Inputs.
2. Click Create New Input.
3. In the Add Inputs window, complete the following fields:

   Field	Description
   Name	Give your input a name using letters, numbers, and underscores.
   Description	Optionally, give your input a brief description to distinguish it from other inputs.
   Managers	Select one or more managers to specify from which Cisco UCS server to collect data for this input.
   Templates	Select one or more templates to define which Cisco UCS classID or set of classIDs should be included in this input.
   Polling Interval	Adjust the default Polling Interval if desired.
   Source Type	Adjust the default Source Type if desired.
   Index	Adjust the default index if desired.

4. Click Add to enable the input. You can return to this input to adjust your input setting by selecting Edit.

   Although you can select as many templates as you want, limit the number of templates that you invoke with a single input to avoid creating too many concurrent sessions. The UCS manager can support 200 sessions in parallel at maximum load.

5. Go to the Search & Reporting app and search for sourcetype=cisco:ucs:* to confirm that Splunk Enterprise is indexing events as expected through the add-on.

Configure the Splunk Add-on for Cisco UCS with configuration files

You can also configure Cisco UCS Managers, Templates, and Inputs using configuration files.

Configure Cisco UCS Managers

To configure Cisco UCS Managers, perform the following steps:

1. To add a new Cisco UCS Manager, add the following stanza to $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-ucs/local/splunk_ta_cisco_ucs_servers.conf:

   # [Cisco UCS Manager name, using only letters, numbers, and underscores]
   # account_name = Your Cisco UCS account name, in plaintext
   # account_password = Your Cicsco UCS password, in plaintext
   # description = A description of the Cisco UCS Manager
   # disable_ssl_verification = True or False
   # server_url = Host of the Cisco UCS Manager
   

2. Save the file.
3. Restart the Splunk platform by running > splunk restart.

Configure Cisco UCS Templates

To configure Cisco UCS Templates, perform the following steps:

1. To add a new Cisco UCS Template, add the following stanza to $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-ucs/local/splunk_ta_cisco_ucs_templates.conf:

   # [Cisco UCS Template name, using only letters, numbers, and underscores]
   # content = The Cisco UCS classID
   # description = A brief description of what this Template configures

2. Save the file.
3. Restart the Splunk platform by running > splunk restart.

Configure Cisco UCS Inputs

To add Cisco UCS inputs, perform the following steps:

1. To add a new Cisco UCS Input, add the following stanza to $SPLUNK_HOME/etc/apps/Splunk/TA/cisco-ucs/local/inputs.conf
   1. [Cisco UCS Input name, using only letters, numbers, and underscores]
   2. description = A brief description of the Input
   3. disabled = False
   4. index = default
   5. interval = 300
   6. sourcetype = cisco:ucs
   7. servers = server1
   8. templates = UCS_Fault
2. Save the file.
3. Restart the Splunk platform by running > splunk restart.

Set time zone details

If a new sourcetype has a timestamp in its events, then configure your server's time configurations to match the time configurations in the Splunk Add-on for Cisco UCS.

The following sources are configured in UTC by default in the $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-ucs/default/props.conf file of the Splunk Add-on for Cisco UCS.

• cisco:ucs:swSystemStats
• cisco:ucs:etherTxStats
• cisco:ucs:etherPauseStats
• cisco:ucs:etherRxStats
• cisco:ucs:etherLossStats
• cisco:ucs:etherErrStats
• cisco:ucs:adaptorVnicStats
• cisco:ucs:processorEnvStats
• cisco:ucs:computeMbTempStats
• cisco:ucs:computeMbPowerStats
• cisco:ucs:equipmentChassisStats
• cisco:ucs:equipmentPsuStats

If your Cisco UCS server is sends events in a different timezone, then configure all sourcetypes (including the sourcetypes listed above) in $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-ucs/local/props.conf to override the default timezone setting. See Specify time zones in props.conf in the Getting Data In manual to learn more.