Upgrade to the latest version of the Splunk App for NetApp Data ONTAP

Upgrade to the latest released version of the Splunk App for NetApp Data ONTAP.

1. Verify your Splunk environment is working properly. See "Platform and hardware requirements" in this manual for supported Splunk platform versions for this release. See "How to upgrade Splunk Enterprise" to upgrade to a new Splunk platform version.
2. Backup your existing deployment See "Back up configuration information" in the Admin Manual and "Back up indexed data" in the Managing Indexers and Clusters Manual.
3. Download the Splunk App for NetApp Data ONTAP and the Splunk Add-on for NetApp Data ONTAP from Splunkbase to a location in your environment.
4. Upgrade your Scheduler
   1. Stop your scheduler.
   2. Replace existing copies of Splunk_TA_ontap, SA-Hydra and SA-Utils with the 2.1.5 or later versions of Splunk_TA_ontap, SA-Hydra and SA-VMNetAppUtils.
   3. Delete splunk_app_netapp.
   Note: If you use your scheduler as a search head for your deployment and wants to keep your app running while collecting data on your scheduler, then replace all four app components with the 2.1.5 or later version.
5. Upgrade Forwarder (DCN)
   1. Replace existing copies of Splunk_TA_ontap, SA-Hydra and SA-Utils with the 2.1.5 or later versions of Splunk_TA_ontap, SA-Hydra and SA-VMNetAppUtils.
6. Upgrade Indexer
   1. Enable maintenance mode on your indexer master node.
   2. Upgrade Splunk_TA_ontap in etc/master-apps on your indexer master node.
   3. Remove inputs.conf from Splunk_TA_ontap/default and inputs.conf.spec, which is located in Splunk_TA_ontap/README.
   4. Remove SA-Hydra and SA-Utils, if present.
   5. Verify indexes.conf is present in etc/master-apps/_cluster/local with all app indexes defined and repFactor=auto is set for each defined app index.
   6. Restart your indexer master node.
   7. Push your updated configuration bundle from the indexer master node.
7. Upgrade Search head
   1. Replace existing copies of /SA-Hydra, /SA-VMNetAppUtils, /Splunk_TA_ontap, and /splunk_app_netapp with the 2.1.5 or later versions of /SA-Hydra, /SA-VMNetAppUtils, /Splunk_TA_ontap, and /splunk_app_netapp on your search head or search head deployer. (For search head clustering, components are located in etc/shcluster/apps)
   2. Push bundles from your deployer
8. Start your scheduler.
9. Validate your installation Check that you correctly installed the Splunk App for NetApp Data ONTAP and that you have data coming into the app. See "Log in and get started" in this manual.

Upgrade from tsidx namespaces to data model acceleration

Version 2.1.0 of the Splunk App for NetApp Data ONTAP replaces the use of tsidx namespacing with the use of data models and data model acceleration. Existing tsidx files will be not be deleted after the upgrade, and will not be utilized after the upgrade to version 2.1.0 of the Splunk App for NetApp Data ONTAP.

Previously (in versions 2.0.x and earlier), tsidx scheduling and storage was done on the search head. Starting in version 2.1.0, Data model acceleration is distributed and stored across your indexers. Spreading this task across your indexers instead of on your search head will promote more scalability across your installation.

See About data models to learn more.

Data model acceleration speeds up reporting for the entire set of attributes (fields) that you define in a data model. Data model acceleration creates summaries for the specific set of fields you and your Pivot users want to report on, accelerating the dataset represented by that collection of fields rather than a particular search against that dataset. It may take a few hours to create the data model acceleration depending on the amount of data that is historically indexed. Data that has not been accelerated yet (for example, live streaming data) will still be captured in queries by falling back to normal search for that data. Splunk Enterprise always process all summaries first, so accelerated data arrives faster.

See Accelerate data models to learn more.

Index storage size on your NetApp indexes will remain unchanged with the implementation of data model acceleration. Previously (in versions 2.0.x and earlier), the age-based retention policy was 6 years, and the size-based retention policy was unlimited. Even if your raw data was deleted, tsidx data still existed, and performance and inventory charts were populated.

Starting in version 2.1.5, Data model acceleration has a 7-day retention policy, and does not have an established size-based retention policy, and can, by default, take up an unlimited amount of disk space. Data model acceleration is dependent on your raw data. So if your raw data has been deleted, the accelerated data cannot be preserved, and your performance and inventory charts cannot be populated.

Click here to learn how to set size-based retention policies.

Your deployment's Data Model acceleration properties are located in datamodels.conf on your indexers. See "Data model acceleration configuration file reference" to see the datamodels.conf default acceleration configuration.

Map existing tsidx namespaces to data model nodes

Use the table below to map your existing namespaces to nodes in the data models used by the NetApp app.

Namespace	Data model	Node name (not case sensitive)
tsidx-perf-aggr-ontap	NetApp ONTAP	NetAppPerformance.Aggr_Performance
tsidx-perf-disk-ontap	NetApp ONTAP	NetAppPerformance.Disk_Performance
tsidx-perf-lun-ontap	NetApp ONTAP	Collected but not aggregated in the data model
tsidx-perf-qtree-ontap	NetApp ONTAP	Collected but not aggregated in the data model.
tsidx-perf-system-ontap	NetApp ONTAP	NetAppPerformance.System_Performance
tsidx-perf-vfiler-ontap	NetApp ONTAP	Collected but not aggregated in the data model.
tsidx-perf-volume-ontap	NetApp ONTAP	NetAppPerformance.Volume_Performance