Splunk® Supported Add-ons

Splunk Add-on for EMC VNX

Block source types reference for the Splunk Add-on for EMC VNX

The following tables describe the meanings for the key fields of each kind of VNX Block event.

VNX Block Agent

vnx:block:agent events show the software and hardware inventory of the storage processor. Each storage processor produces these events.

  • Sourcetype: vnx:block:agent
  • Fields:
Field Name Field Description
ip IP address of this storage processor
revision Software revision of the agent
sp_memory Storage processor's memory in megabyte
physical_node Physical node name for this processor
os The operating system in which the processor is running
cabinet Cabinet information for this processor
model Model information for this processor
agent_name Agent name
model_type Model type
sp_id Storage Process ID. The value must be "A" or "B"
node Node information
agent_rev Agent software revision
site Location short location code, such as "SF"
array_serial_no Array serial number which is the unique ID for the array
  • Event Example:

revision=05.32.000.5.201,ip=10.185.11.29,sp_memory=8192,physical_node=K10,os=N/A,
cabinet=DPE7,model=VNX5300,agent_name=K10,model_type=Rackmount,sp_id=B,
node=B-APM00123303344,site=SF,agent_rev=7.32.25 (1.56),
array_serial_no=APM00123303344

VNX Block RAID Group

vnx:block:raidGroup events show brief information about RAID groups in the array.

  • Sourcetype: vnx:block:raidGroup
  • Fields:
Field Name Field Description
id RAID group ID
rtype RAID group type
raw_cap Total raw capacity of the RAID group
logical_cap Total logical capacity of the raid group (raw capacity minus RAID overhead)
state State of the RAID group
array_serial_no Array serial number which is the unique ID for the array
  • Event Example:

logical_cap=3377570,free_cap=3377570,id=1,state=Explicit_Remove,raw_cap=6755140,
rtype=r6,array_serial_no=APM00123303344

VNX Block Storage Pool

vnx:block:storagepool events show brief information about storage pools in the array.

  • Sourcetype: vnx:block:storagePool
  • Fields:
Field Name Field Description
id Storage Pool ID
disk_type Underlying disk technology. "N/A" if not available
raw_cap Total raw capacity of the storage pool
user_cap Total logical capacity of the storage pool (raw capacity minus storage pool overhead)
used_cap Used capacity of the storage pool
status State of the storage pool
array_serial_no Array serial number which is the unique ID for the array
  • Event Example:

name=CIFS_Pool,disk_type=NL SAS,raw_cap=9391897,id=2,status=OK(0x0),
rtype=r_5,used_cap=3169314,user_cap=7507242,free_cap=4337928,
array_serial_no=APM00123303344

VNX Block Drive

vnx:block:drive events show brief information about physical disk spindles in the array.

  • Sourcetype: vnx:block:drive
  • Fields:
Field Name Field Description
id Disk drive ID, Bus No + "_" + Enclosure No + "_" + Disk ID
capacity Total capacity of the drive
state State of the drive
current_speed Current speed of the drive
max_speed Maximum speed of the drive (compare max_speed and current_speed to see if the drive is in full speed)
is_hotspare Is this drive a hot spare ? True or False
raid_group RAID group ID to which this disk belongs. "-1" if the drive does not belong to any RAID group
drive_type Drive's physical type, say Fibre Channel or NL SAL. "N/A" if not available
vendor Drive's vendor
product_revision Product revision of the drive
product_id Product ID of the drive
array_serial_no Array serial number which is the unique ID for the array
  • Event Example:

product_revision=C1D6,is_hotspare=False,product_id=HUS72302 NEO2000,
current_speed=6Gbps,drive_type=NL SAS,vendor=HITACHI,capacity=1878379,
raid_group=122,id=0_1_13,state=Enabled,max_speed=6Gbps,
array_serial_no=APM00123303344

VNX Block Device

vnx:block:drive events show brief information about logical devices in the array.

  • Sourcetype: vnx:block:device
  • Fields:
Field Name Field Description
name Device name
id Device ID, an integer
capacity Total capacity of the device
state State of the device
uid Global WWN
is_meta Is the device a meta device? True or False
is_thin Is the device a thin device ? True or False
raid_group RAID group ID to which this device is carved from. "-1" if not belong to any RAID group
drive_type Physical spindle's type of the device. "N/A" if not available
vendor Drive's vendor
product_revision Product revision of the drive
product_id Product ID of the drive
array_serial_no Array serial number which is the unique ID for the array
  • Event Example:

default_owner=SP A,is_thin=False,name=LUN 4095,is_pool_based=False,state=Bound,
drive_type=N/A,raid_type=N/A,uid=60:01:06:61:23:45:67:89:B4:23:00:00:5E:99:00:00,
capacity=11261,is_meta=False,raid_group=-1,id=4095,is_private=False,
current_owner=SP A,array_serial_no=APM00123303344

VNX Block Storage Group

vnx:block:storagegroup events show the brief information about which ports the host is connected to the array through which HBA.

  • Sourcetype: vnx:block:storageGroup
  • Fields:
Field Name Field Description
HBA Shows the HBA initiator information of this storage group
spid Storage process ID, either "A" or "B"
spport Storage port on the storage processor
hostname hostname of the connected host
array_serial_no Array serial number which is the unique ID for the array
  • Event Example:

HBA=iqn.2003-01.com.splunk.bd:bd-esx-03-812,spid=SP B,spport=4,
hostname=bd-esx-03.bd.splunk.com,array_serial_no=APM00123303344
  • CIM data models: none

VNX Block Pool Device

vnx:block:poolDevice events map devices to pools.

  • Sourcetype: vnx:block:poolDevice
  • Fields:
Field Name Field Description
pool_name Storage pool name
pool_id Storage pool ID
device_id Device ID
array_serial_no Array serial number which is the unique ID for the array
  • Event Example:
pool_name=CIFS_Pool,pool_id=2,device_id=101,array_serial_no=APM00123303344
  • CIM data models: none

VNX Block Pool Drive

vnx:block:poolDrive events map drives to pools.

  • Sourcetype: vnx:block:poolDrive
  • Fields:
Field Name Field Description
pool_name Storage pool name
pool_id Storage pool ID
drive_id Drive ID (Bus No + "_" + Enclosure No + "_" + Disk ID)
array_serial_no Array serial number which is the unique ID for the array
  • Event Example:

pool_name=CIFS_Pool,pool_id=2,drive_id=0_1_11,array_serial_no=APM00123303344

  • CIM data models: none

VNX Block RAID Group Drive

vnx:block:rgDrive events maps the drive to the RAID Group.

  • Sourcetype: vnx:block:rgDrive
  • Fields:
Field Name Field Description
rg_id RAID Group ID
drive_id Drive ID (Bus No + "_" + Enclosure No + "_" + Disk ID)
array_serial_no Array serial number which is the unique ID for the array
  • Event Example:

drive_id=0_0_3,rg_id=1,array_serial_no=APM00123303344

  • CIM data models: none

VNX Block Storage Group Device

vnx:block:sgDevice events maps the device to the Storage Group.

  • Sourcetype: vnx:block:sgDevice
  • Fields:
Field Name Field Description
storagegroup_name Storage Group Name
drive_id Drive ID (Bus No + "_" + Enclosure No + "_" + Disk ID)
array_serial_no Array serial number which is the unique ID for the array
  • Event Example:

device_id=7,storagegroup_name=SG_bd-esx-03.bd.splunk.com,array_serial_no=APM00123303344

  • CIM data models: none

VNX Block RAID Group State

vnx:block:rgState events show the status of the RAID Group.

  • Sourcetype: vnx:block:rgState
  • Fields:
Field Name Field Description
raidgroup_id RAID Group ID
state Current state of the RAID Group
array_serial_no Array serial number which is the unique ID for the array
  • Event Example:

state=Explicit_Remove,raidgroup_id=1,array_serial_no=APM00123303344

  • CIM data models: none

VNX Block Storage Pool State

vnx:block:storagePoolState events show the status of the Storage Pool.

  • Sourcetype: vnx:block:storagePoolState
  • Fields:
Field Name Field Description
id Storage Pool ID
name Name of the storage pool
state Current state of the storage pool
array_serial_no Array serial number which is the unique ID for the array
  • Event Example:

id=1,name=CIFS_Pool_0,state=Ready,array_serial_no=APM00123303344

  • CIM data models: none

VNX Block Device State

vnx:block:deviceState events show the status of a device.

  • Sourcetype: vnx:block:deviceState
  • Fields:
Field Name Field Description
device_id Device ID
device_name Name of the device
state Current state of the device
array_serial_no Array serial number which is the unique ID for the array
  • Event Example:

device_id=1006,device_name=CIFSLUN_1006,state=Bound,array_serial_no=APM00123303344

  • CIM data models: none

VNX Block Drive State

vnx:block:driveState events show the status of a drive.

  • Sourcetype: vnx:block:driveState
  • Fields:
Field Name Field Description
drive_id Drive ID
state Current state of the drive
hard_read_error Hard read error count in total
hard_write_error Hard write error count in total
soft_read_error Soft read error count in total
soft_write_error Soft write error count in total
array_serial_no Array serial number which is the unique ID for the array
  • Event Example:

hard_read_error=0,state=Enabled,hard_write_error=0,soft_read_error=0,drive_id=0_1_13, soft_write_error=0,array_serial_no=APM00123303344

  • CIM data models: none

VNX Block CRU State

vnx:block:crusState events show the status of the CRUs (Customer Replaceable Units) in the storage system, including fans, LCCs, storage processors, SPS etc.

  • Sourcetype: vnx:block:crusState
  • Fields:
Field Name Field Description
cpu_module_a_state Status of the CPU module on SP A
cpu_module_b_state Status of the CPU module on SP B
dimm_module_a_state Status of the DIMM module on SP A
dimm_module_b_state Status of the DIMM module on SP B
spsa_state Cabling status for SPS (Standby power supply A)
spsb_state Cabling status for SPS (Standby power supply B)
powera_state SP A power supply
powerb_state SP B power supply
spa_state Storage Processor A state
spb_state Storage Processor B state
spa_io_module_0_state SP A I/O Module 0 state
spa_io_module_1_state SP A I/O Module 1 state
spb_io_module_0_state SP B I/O Module 0 state
spb_io_module_1_state SP B I/O Module 1 state
lcc_a_state LCC A state
lcc_b_state LCC B state
array_serial_no Array serial number which is the unique ID for the array
  • Event Example:

powerb_state=Present,cpu_module_a_state=N/A,spa_io_module_1_state=N/A, spb_io_module_0_state=N/A,spsa_state=N/A,spa_state=N/A,lcc_a_state=Present, spa_io_module_0_state=N/A,spb_io_module_1_state=N/A, location=DAE6S Bus 0 Enclosure 1,spb_state=N/A,cpu_module_b_state=N/A, dimm_module_a_state=N/A,spsb_state=N/A,dimm_module_b_state=N/A, lcc_b_state=Present,powera_state=Present,array_serial_no=APM00123303344

  • CIM data models: none

VNX Block SFP State

vnx:block:sfpState events show the status of the backend SFP (Small Form-factor Pluggable) optical modular transceiver.

  • Sourcetype: vnx:block:sfpState
  • Fields:
Field Name Field Description
bus_id Backend Bus Number
spa_sfp_state SP A SFP state
spb_sfp_state SP B SFP state
array_serial_no Array serial number which is the unique ID for the array
  • Event Example:

spa_sfp_state=N/A,bus_id=Bus 1,spb_sfp_state=N/A,array_serial_no=APM00123303344

  • CIM data models: none

VNX Block Storage Processor Performance

vnx:block:spPerf events show the storage processor's I/O and CPU performance metrics.

  • Sourcetype: vnx:block:spPerf
  • Fields:
Field Name Field Description
avg_busy_queue_length Dynamically calculated metric for the average busy queue length
avg_busy_queue_width Dynamically calculated metric for the average busy queue width
response_time Dynamically calculated metric for the total duration between when the request enters a queue to when the VNX storage processor finishes processing the request
service_time Dynamically calculated metric for the time the VNX storage processor takes to handle the I/O
sys_fault_led System fault LED
statistics_logging Statistics logging enabled or disabled
sp_read_cache_state Storage processor read cache disabled or enabled
sp_write_cache_state Storage processor write cache disabled or enabled
max_requests MAX requests count
total_reads Read operation per second
total_writes Write operation per second
prct_busy Storage processor busy percent (0 ~ 100)
prct_idle Storage processor idle percent (0 ~ 100)
read_requests Host read requests per second
write_requests Host write requests per second
blocks_read Read blocks per second
blocks_written Written blocks per second
sum_queue_lengths_by_arrivals I/O queue sum length per second
arrivals_to_no_zero_queue I/O request to non zero queue per second
hw_flush_on Flush count per second due to high water mark reached
idle_flush_on Flush count per second due to idle reached
lw_flush_off Flush count per second due to low water mark reached
write_cache_flushes Write cache flush count per second
write_cache_blocks_flushes Write cache flush blocks per second
controller_busy_ticks Storage processors controller CPU busy ticks
controller_idle_ticks Storage processors controller CPU idle ticks
serial_no_for_the_sp Storage processor serial number
internal_bus_1_busy_ticks Internal bus 1 CPU busy ticks
internal_bus_1_idle_ticks Internal bus 1 CPU idle ticks
internal_bus_2_busy_ticks Internal bus 2 CPU busy ticks
internal_bus_2_idle_ticks Internal bus 2 CPU idle ticks
internal_bus_3_busy_ticks Internal bus 3 CPU busy ticks
internal_bus_3_idle_ticks Internal bus 3 CPU idle ticks
internal_bus_4_busy_ticks Internal bus 4 CPU busy ticks
internal_bus_4_idle_ticks Internal bus 4 CPU idle ticks
internal_bus_5_busy_ticks Internal bus 5 CPU busy ticks
internal_bus_5_idle_ticks Internal bus 5 CPU idle ticks
array_serial_no Array serial number which is the unique ID for the array
  • Event Example:

lw_flush_off=0.0,internal_bus_2_idle_ticks=0.0,max_requests=0, sp_read_cache_state=Enabled,internal_bus_3_busy_ticks=0.0, controller_idle_ticks=15.6866330255,write_cache_flushes=0.455156191414, statistics_logging=ON,internal_bus_4_idle_ticks=0.0, controller_busy_ticks=0.536434082738,prct_idle=96.9, sp_write_cache_state=Enabled,sp_id=A,idle_flush_on=0.0487667347943, write_cache_blocks_flushed=5.91703048838,internal_bus_1_busy_ticks=0.0, blocks_read=0.0,blocks_written=112.878735471,pcrt_idle=96.9, arrivals_to_non_zero_queue=1.56053551342,internal_bus_5_idle_ticks=0.0, internal_bus_1_idle_ticks=0.0,average_requests=0,internal_bus_2_busy_ticks=0.0, write_requests=7.00615423212,internal_bus_4_busy_ticks=0.0,prct_busy=3.10, sum_queue_lengths_by_arrivals=0.0,internal_bus_5_busy_ticks=0.0, total_writes=7.00615423212,read_requests=0.0,total_reads=0.0,hw_flush_on=0.0, internal_bus_3_idle_ticks=0.0,serial_no_for_the_sp=FCNSS123100117, sys_fault_led=OFF,array_serial_no=APM00123303344

VNX Block Drive Performance

vnx:block:drivePerf events show the disk drives' I/O and CPU performance metrics.

  • Sourcetype: vnx:block:drivePerf
  • Fields:
Field Name Field Description
drive_id Drive ID
number_reads Number reads per second
number_written Number written per second
kbytes_written Write KB per seconds
kbytes_read Read KB per seconds
busy_ticks CPU Busy ticks per second
idle_ticks CPU Idle ticks per second
array_serial_no Array serial number which is the unique ID for the array
  • Event Example:

idle_ticks=16.0158687301,kbytes_written=0.0,number_reads=0.646075384016, kbytes_read=330.790596616,number_writes=0.0,drive_id=0_1_3,busy_ticks=0.0, array_serial_no=APM00123303344

VNX Block Device Performance

vnx:block:devicePerf events show the devices' I/O and CPU performance metrics.

  • Sourcetype: vnx:block:devicePerf
  • Fields:
Field Name Field Description
device_id Device ID
device_name Device Name
block_written Write blocks per seconds
block_read Read blocks per seconds
busy_ticks CPU Busy ticks per second
idle_ticks CPU Idle ticks per second
array_serial_no Array serial number which is the unique ID for the array
read_requests Read requests per second
write_requests Write requests per second
pool_name Pool name of the device
  • Event Example:

idle_ticks=210704.343963,busy_ticks=0.0, read_requests=0.0,write_requests=0.0,pool_name=Pool 0, array_serial_no=APM00123303344

Last modified on 21 July, 2021
Troubleshoot the Splunk Add-on for EMC VNX   File source types reference for the Splunk Add-on for EMC VNX

This documentation applies to the following versions of Splunk® Supported Add-ons: released

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters