Upgrade to Splunk App for NetApp Data ONTAP 2.1.1

Upgrade to the latest released version of the Splunk App for NetApp Data ONTAP. See "Platform and hardware requirements" in this manual for supported Splunk platform versions for this release. See "How to upgrade Splunk Enterprise" to upgrade to a new version of Splunk Enterprise.

Backup your existing deployment

Before you upgrade, backup your existing Splunk Enterprise deployment. See "Back up configuration information" in the Admin Manual and "Back up indexed data" in the Managing Indexers and Clusters Manual.

Upgrade a distributed deployment

To upgrade your distributed Splunk Enterprise environment, see "Upgrade your distributed environment" in the Distributed Deployment Manual.

Upgrade to Splunk App for NetApp Data ONTAP 2.1.1

Download the Splunk App for NetApp Data ONTAP package, from Splunkbase to a location in your environment.

Upgrade Splunk search heads

1. Stop the distributed collection scheduler, if is running. Do this by stopping Splunk Enterprise on the search head, or stop the scheduler in the Collection configuration page of the Splunk App for NetApp Data ONTAP.

2. Get the file splunk-app-for-netapp-data-ontap_<number>.zip and put it in $SPLUNK_HOME.

3. In $SPLUNK_HOME unzip the app package.

unzip splunk-app-for-netapp-data-ontap_<number>.zip

4. Verify that you copied all of the apps and the sub directories correctly to $SPLUNK_HOME/etc/apps.

SA-Hydra/…

SA-Utils/…

splunk_app_netapp/…

Splunk_TA_ontap/…

5. Restart Splunk Enterprise in each of the locations where you installed the Splunk App for NetApp Data ONTAP, or restart the scheduler in the Collection configuration page of the app. For both Windows and Unix instructions, see "Start and stop Spunk" in the Splunk Admin Manual.

Upgrade Splunk indexers

1. Stop Splunk Enterprise on the indexer.

2. Get the following files from the app download package, splunk-app-for-netapp-data-ontap_<number>.zip and install them in $SPLUNK_HOME on each indexer.

SA-Utils/…

SA-Hydra/…

Splunk_TA_ontap/…

3. (Optional) For a clustering indexer environment, SA-Utils should be deleted from master-app folder.

4. Start Splunk Enterprise.

Upgrade the data collection node

1. Stop Splunk Enterprise on the data collection node.

2. On the data collection node, copy the following components from splunk-app-for-netapp-data-ontap_<number>.zip download package and put them in the $SPLUNK_HOME/etc/apps folder on the data collection node.

• SA-Utils
• SA-Hydra
• Splunk_TA_ontap

3. Start Splunk Enterprise.

Validate your installation

Check that you correctly installed the Splunk App for NetApp Data ONTAP and that you have data coming into the app. See "Log in and get started" in this manual.

Upgrade from tsidx namespaces to data model acceleration

Version 2.1.0 of the Splunk App for NetApp Data ONTAP replaces the use of tsidx namespacing with the use of data models and data model acceleration. Existing tsidx files will be not be deleted after the upgrade, and will not be utilized after the upgrade to version 2.1.0 of the Splunk App for NetApp Data ONTAP.

Previously (in versions 2.0.x and earlier), tsidx scheduling and storage was done on the search head. Starting in version 2.1.0, Data model acceleration is distributed and stored across your indexers. Spreading this task across your indexers instead of on your search head will promote more scalability across your installation.

See About data models to learn more.

Data model acceleration speeds up reporting for the entire set of attributes (fields) that you define in a data model. Data model acceleration creates summaries for the specific set of fields you and your Pivot users want to report on, accelerating the dataset represented by that collection of fields rather than a particular search against that dataset. It may take a few hours to create the data model acceleration depending on the amount of data that is historically indexed. Data that has not been accelerated yet (for example, live streaming data) will still be captured in queries by falling back to normal search for that data. Splunk Enterprise always process all summaries first, so accelerated data arrives faster.

See Accelerate data models to learn more.

Index storage size on your NetApp indexes will remain unchanged with the implementation of data model acceleration. Previously (in versions 2.0.x and earlier), the age-based retention policy was 6 years, and the size-based retention policy was unlimited. Even if your raw data was deleted, tsidx data still existed, and performance and inventory charts were populated.

Starting in version 2.1.0, Data model acceleration has a 30-day retention policy, and does not have an established size-based retention policy, and can, by default, take up an unlimited amount of disk space. Data model acceleration is dependent on your raw data. So if your raw data has been deleted, the accelerated data cannot be preserved, and your performance and inventory charts cannot be populated.

Click here to learn how to set size-based retention policies.

Your deployment's Data Model acceleration properties are located in datamodels.conf on your indexers. See "Data model acceleration configuration file reference" to see the datamodels.conf default acceleration configuration.

Map existing tsidx namespaces to data model nodes

Use the table below to map your existing namespaces to nodes in the data models used by the NetApp app.

Namespace	Data model	Node name (not case sensitive)
tsidx-perf-aggr-ontap	NetApp ONTAP	NetAppPerformance.Aggr_Performance
tsidx-perf-disk-ontap	NetApp ONTAP	NetAppPerformance.Disk_Performance
tsidx-perf-lun-ontap	NetApp ONTAP	Collected but not aggregated in the data model
tsidx-perf-qtree-ontap	NetApp ONTAP	Collected but not aggregated in the data model.
tsidx-perf-system-ontap	NetApp ONTAP	NetAppPerformance.System_Performance
tsidx-perf-vfiler-ontap	NetApp ONTAP	Collected but not aggregated in the data model.
tsidx-perf-volume-ontap	NetApp ONTAP	NetAppPerformance.Volume_Performance