What data the Splunk App for NetApp Data ONTAP collects

What data can I get

In the Splunk App for NetApp Data ONTAP we collect API data from NetApp storage controllers running Data ONTAP in 7-mode or cluster mode. We collect performance data about specific inventory objects and data about the configuration of your NetApp storage infrastructure. We collect logs on NetApp filers that contain basic information about their operation. This gives you the visibility you need into the health and state of your storage infrastructure enabling you to better manage it.

API data collection is managed by the Hydra scheduler working with the data collection nodes. The exception to this is the collection of syslog data from the filers.

CIM compliance

The Splunk App for NetApp Data ONTAP supports the Common Information Model (CIM) in Splunk 6.0 and later. Field aliasing in the Splunk App for NetApp Data ONTAP builds compatibility between the app and the CIM. You can map individual objects in the Splunk app for NetApp Data ONTAP to the CIM equivalent and represent the data in Splunk. Using the data models you can report and pivot on the NetApp objects.

The Common Information Model is available as an Add-on that implements the CIM tables as data models. You can download the Splunk Common Information Model Add-on (Splunk_SA_CIM) from Splunk Apps. For more information on the Splunk Common Information Model Add-on, see the "Common Information Model Add-on" topic in the Splunk Enterprise documentation. See also the Splunk documentation on how to "Understand and use the Common Information Model" in the Knowledge Manager Manual.

You can use the data models available in the Splunk Common Information Model Add-on in two ways:

• You can use them to test whether your fields and tags have been normalized correctly.
• After you've verified that your data is normalized you can use the models to generate reports and dashboard panels via Pivot.

The CIM enables you to identify common events across different technologies and, using the CIM, you can build a variety of specialized searches across the datasets that have been mapped to event categories relevant to the underlying technologies. Splunk_SA_CIM is a repository of data models that can be used with Splunk apps and Splunk 6.0 or later. The CIM identifies the fields that must be present in the data for the dashboards to work, and the tags that need to be assigned to the data for the process to work correctly.

The Splunk App for NetApp Data ONTAP now supports the following event categories in the CIM:

• Compute Inventory
• Performance

For information about the fields in these event categories, read "Standard fields and event category tags" in the Splunk Knowledge Manager manual.

When you add sourcetypes for your data to the Splunk App for NetApp Data ONTAP, refer to the Splunk Enterprise CIM documentation to ensure that you follow the requirements for data processing to CIM standards.

The data we collect

The following NetApp data types are collected by the app:

Data source	Data type	Description
API	Inventory data	This data is collected from the Net App filers in 7-mode and Cluster mode and contain information about specific object instances. These objects are volume, disk, LUN, aggregate, vFiler, QTree, and Quota.
API	Performance data	Performance data is collected from the following NetApp filer objects in 7-mode and Cluster mode: volume, disk, LUN, aggregate, vFiler, QTree, and Quota. Performance counters collect data for performance objects.
API	Options data	The app collects 7-mode options data and Cluster cifs-options data.
API	EMS data	The app collects details of critical activities from the NetApp filer Event Management System (EMS).
syslog	NetApp filer logs	These are log files generated by the NetApp filer in 7-mode and cluster mode. This data is collected by configuring the NetApp filers to send the logs to a syslog server (over the network).

Key performance counters

You can collect data for each performance object in your storage system. We monitor the performance of your storage systems by collecting the key performance counters for your storage devices so that you can be proactive in configuring your system to meet your storage demands and troubleshooting your performance issues. This enables you to identify and diagnose problems early.

Example using performance counters for the Volume object

We use performance counters in some of the searches that power the dashboards in the Splunk App for NetApp Data ONTAP. For example, in the Volume Detail dashboard we use the latency values (average, other, read, and write) to chart the latency values over time for reads to the volume, writes to the volume, average latency for all operations on the volume, and the average time for other operations on the volume. All operations are reported in milliseconds. Look at the "Selected Volume Latency (ms)" panel in the Volume Detail dashboard to see the results of the search.

sourcetype=ontap:perf source=VolumePerfHandler host="host_name" objname="volume_name" | timechart first(eval(avg_latency_average/1000)) as avg_latency_average first(eval(other_latency_average/1000)) as avg_latency_average first(eval(write_latency_average/1000)) as write_latency_average first(eval(read_latency_average/1000)) as read_latency_average by objname

You can also create your own custom searches using the storage performance counters. Run your search in the Search bar in Splunk. For example, you can use the performance counter "Average Volume Latency" in a search to collect the average latency of all of the operations on the volume and then display the last received value by host and volume name.

An example of a search that can do this is:

index=ontap sourcetype=ontap:perf source=VolumePerfHandler avg_latency_average=* | rename objname as volume_name | stats last(avg_latency_average) by host,volume_name

The result is a table that displayed the host names, the volume name on the host, and the last latency values.