Configure data collection intervals

The Splunk App for NetApp Data ONTAP collects metrics for performance data and inventory data. Collection intervals are set in the $SPLUNK_HOME/etc/apps/Splunk_TA_ontap/default/ta_ontap_collection.conf file. The following two keys, megaperf_interval and megainv_interval, included in the default stanza of this file are used to set the intervals for data collection. The value that you assign to the interval reflects how you want to collect data in your environment. Use the number of objects (such as disk, volume, lun, qtree, or any other "inventory" object) on the filer to determine the interval settings for megaperf_interval and the megainv_interval for each filer. The most critical interval is the megaperf_interval. This interval governs the granularity of the performance data you collect and the total number of events coming into the system.

To collect data at the most granular level you must know the minimum performance interval. In this app, the minimum performance interval for performance data is on average 0.1 to 0.2 seconds per object on the filer, given that no network issues impact collection.

For example, to calculate the recommended megaperf_interval in seconds for 3000 volumes, multiply the number of volumes by the minimum performance interval (0.2). This gives an interval value of 600 seconds.

The volume of data we collect for the megainv_interval is less than that of the megaperf_interval and the data is less frequent. We recommend a collection interval value that is 5 to 20 times the performance interval, so long as the interval is set to a value less than 60 minutes. To schedule performance and inventory collection on the same intervals, use the guidelines described above for collecting the data. Aggressive collection of inventory data (on the same frequency with which performance data is being collected) is not recommended.

The following is an example of the interval settings in the ta_ontap_collection.conf file

[default]

megaperf_interval = 60

megaperf_expiration = 55

megainv_interval = 600

megainv_expiration = 595

How to limit performance data collection

To reduce the volume of ONTAP performance data coming into the app, or to reduce the number of tasks that expire before they can complete, you can change the interval setting in the $SPLUNK_HOME/etc/apps/Splunk_TA_ontap/default/ta_ontap_collection.conf file. This affects the frequency with which ONTAP performance data is collected. Changing the collection interval also has an effect on the granularity of the ONTAP data you collect.

To change interval settings, create a local version of the file, if it does not already exist, ($SPLUNK_HOME/etc/apps/Splunk_TA_ontap/local/ta_ontap_collection.conf) and specify the changes here.

On the search head that runs the scheduler:

1. Edit the file $SPLUNK_HOME/etc/apps/Splunk_TA_ontap/local/ta_ontap_collection.conf. If it does not exist, create a new file.
2. Include the following stanza that affects ONTAP performance data collection:

   [default]

   megaperf_interval = 60

   megaperf_expiration = 55

   megainv_interval = 600

   megainv_expiration = 595

3. Restart Splunk.

Keep the value that you assign to expiration 5 to 10 seconds lower than the value you assign to the interval.