Set up the Splunk Add-on for NetApp Data ONTAP to collect data from your ONTAP environment

Step 1: Configure user roles

There are two default user roles defined in the Splunk Add-on for NetApp Data ONTAP and the Splunk App for NetApp Data ONTAP:

• The splunk_ontap_admin role: This role gives you permission to configure the Splunk Add-on for NetApp Data ONTAP for data collection.
• The splunk_ontap_user role: This role gives you permission to use the add-on. It does not give you permission to configure the add-on.

Configure roles for the users of the add-on on the following components:

• Scheduler (If using a separate scheduler)
• Search head (or the combined indexer and search head)

Assign roles to each users

1. Log in to Splunk Web and enter the IP address and port number of the OS hosting your search head and/or scheduler:

   http://<ipaddress>:8000/

2. Select the Splunk Add-on for NetApp Data ONTAP from the Apps menu, and navigate to the Collection Configuration page. If this is your first time installing the app, then you are automatically redirected to the Setup page. Accept all of the default settings on the Setup screen, then click Save. For most installations the default settings work.
3. In Settings, select Users and authentication: Access controls, then select Users.
4. Give the admin user the splunk_ontap_admin role so that the admin can run scheduled searches. Add splunk_ontap_admin to the "admin" account.
5. Provide admin_all_objects capability to the splunk_ontap_admin role.
   1. Go to the Settings>Access controls>Roles>splunk_ontap_admin.
   2. Add admin_all_objects capability.
   3. click Save.

Step 2: ONTAP Collection Configuration

In Splunk Web on your search head, select Add-on for ONTAP from the app menu,. This brings you to the Splunk Add-on for NetApp Data ONTAP Collection Configuration dashboard.

Use the ONTAP Collection Configuration dashboard as a single point of configuration for ONTAP servers instead of having to manage the credentials for each machine individually. If your servers have the same administration credentials (admin/password), then realm based access simplifies the process of adding ONTAP servers to the Splunk Add-on for NetApp Data ONTAP. Using this dashboard you can view or delete realms, or change the credentials for a realm. When you change the credentials for a realm, this change can affect a single machine or a group of ONTAP servers that all belong to the same realm.

The dashboard lists all of the realms defined within the app context for the ONTAP servers from which you collect API data. The page displays the defined realms, the user names associated with each realm, and the app to which it belongs.

Add Data Collection Node

Data collection nodes (DCN) are managed by the scheduler. In a search head clustering (SHC) deployment, the DCN scheduler must be deployed on its own, dedicated search head. Do not deploy the DCN Scheduler on any individual search heads within the SHC.

1. On the ONTAP Collection Configuration dashboard, in the Data collection node panel, select Add Data Collection Node to add a new data collection node to register it with your scheduler.
2. Configure this node to collect data from your environment by entering the settings for the data collection node. See the Data Collection Node configuration settings table below.

   Field	Value
   Splunk Forwarder URI	The address or port of the DCN. For example, https://<host_name_or_ip_address_of_DCN>:8089.
   Splunk Forwarder Username	admin.
   Splunk Forwarder Password	The administrator password. Make sure this password is not the Splunk Enterprise default admin password (changeme).
   Worker Processes	Define the number of worker processes you want on the node. This is the number of processes you can run on the data collection node to process the data and forward it to the indexer(s). You can run a maximum of 8 processes per node at the default configuration. The number of worker processes must be one fewer than the number of CPU cores the vCenter Server system granted to the DCN. For example, if the DCN has four CPU cores, the number of worker processes is three.

3. Click Save.
4. Confirm that you correctly configured the DCN by verifying that the DCN, credential validation, and add-on validation all display a green check.
5. Repeat the steps for each DCN.

Add ONTAP Collection

Add one or more NetApp filers and configure them as the source of the data coming into Splunk. Note: Stop and restart the scheduler when you add or remove a filer from your environment.

To add a Filer:

1. On the Collection Configuration dashboard, in the ONTAP Collection Configuration panel, select Add ONTAP Collection to add a new NetApp filer.
2. Configure filer settings in the Add ONTAP Collection dialog.
   1. Enter the fully qualified domain name for the ONTAP server(s), for example, test-na100.example.com. This can be a comma delimited list of ONTAP servers.
   2. Use Realm based Credentials. Check this box if the credentials you are using to access your ONTAP server(s) are part of a realm (controlled by an authentication policy set for a defined set of users).
   3. Enter the Realm: Enter the name that defines the realm.
   4. Enter an ONTAP Username: Enter the username for the user of the app. For example, enter "administrator" as a local user, or enter "splunkadmin@splunk.local" as an Active Directory domain user. You may add an ONTAP User with a "Readonly" role assigned to the "ontapi" application or the "admin" user.
   5. Enter an ONTAP password. This is the password you use to access the the filer(s) in your NetApp environment.
   6. Collect All Performance Categories. This is enabled by default. All performance data is collected by the app unless you specifically request to only collect a subset of the data. To select specific performance data types, uncheck the box to disable automatic collection of all performance data. You can now select the performance categories you want to collect. Check the box beside each category of performance data (Volume, Disk, LUN, Aggregate, Vfiler, Qtree, Quota, System) you want to collect.
   7. Click Save to add a new ONTAP server and display it on the ONTAP Collection Configuration dashboard.
3. Validate that the ONTAP server is configured correctly. To validate that the ONTAP server is configured correctly the search head must be able to establish a connection to the filer. Validation can fail if the search head cannot directly connect to the filer. During the data collection process, all data is transferred through connections established by the data collection node ( on the firewall ports 8089 and 8008). You configured the server correctly if it displays in the list of ONTAP servers in the ONTAP Collection Configuration panel and credential validation is valid and and connection validation is valid.

Step 3: Start the Scheduler

When your ONTAP servers are set up as data collection points and your data collection nodes are set up to gather API data, click Start Scheduler. The scheduler starts the data collection process and data is collected from the resources in your environment.

Note that if you add or modify credentials, restart the scheduler. This pushes the credentials out to the data collection nodes.

You have now completed all of the data collection configuration steps. Splunk is collecting ONTAP data from your environment and you can see the data when you look on the dashboards of the Splunk App for NetApp Data ONTAP.