Configure a cluster deployment

A cluster is a group of of Splunk Enterprise nodes (indexers) configured to replicate each others' data, so that the system keeps multiple copies of all of the data. This process is known as index replication. By maintaining multiple, identical copies of the data, clusters prevent data loss while promoting data availability for searching.

For more information on cluster deployments, see:

• "Key differences between clustered and non-clustered deployments" in the Splunk Enterprise documentation to set up a cluster.
• "The basics of indexer cluster architecture" in the Managing Indexers and Clusters Manual.
• "Back up indexed data" in the Managing Indexers and Clusters Manual.
• "About clusters and index replication" in the "Managing Indexers and Clusters" manual.

Configure a cluster for the Splunk App for NetApp Data ONTAP

The Splunk App for NetApp Data ONTAP requires a stable and supportable Splunk installation.

To set up a cluster environment for the Splunk App for NetApp Data ONTAP:

• Read the topic "Deployment overview". This topic describes the main steps to deploying clusters.
• Follow the instruction in "How to distribute apps to all the peers" to distribute apps across all the peers.

This topic discusses the specific requirements for the Splunk App for NetApp Data ONTAP in a clustered environment.

1. Determine the nodes you want to set up as the master node, peer nodes and search head nodes. Also decide what replication factor you want to implement. The replication factor is the number of copies of raw data that the cluster maintains. It should be less than or equal to the number of search peers (slave nodes).
2. Install the Splunk App for NetApp Data ONTAP on the search head, master nodes, and search peers under the $SPLUNK_HOME/etc/apps directory.
3. Follow the instructions in Deploy a cluster to enable the master node, the peer nodes, and the search head for a clustered environment.
4. Remove the inputs.conf from the Splunk_TA_ontap\default folder and inputs.conf.spec from the Splunk_TA_ontap\README folder before pushing the components to your indexers.
5. Delete SA-VMNetAppUtils and SA-Hydra from the master-apps directory before issuing the 'apply cluster-bundle' command. If SA-VMNetAppUtils is deployed, it will prevent the UI on any indexers from starting up.)
6. To configure indexes across cluster peers, read "Configure the peer indexes". The Splunk App for NetApp Data ONTAP uses the "ontap" index. On the master node, add the new "ontap" index to the $SPLUNK_HOME/etc/master-apps/_cluster/local/indexes.conf file to make the ONTAP data available. When you add a new index stanza, set the repFactor attribute to auto. This causes the index's data to be replicated to other peers in the cluster. Note: To add a new index to a cluster, directly edit indexes.conf. You cannot add an index via Splunk Web or the CLI. This step makes the NetApp data available to the cluster.

   [ontap]

   repFactor=auto

7. On the master node, to distribute the configuration bundle to the search peers, log in to Splunk Web or use the CLI. Distribute the bundle in the $SPLUNK_HOME/etc/master-apps directory.
8. $SPLUNK_HOME/etc/slave-apps/_cluster/local/indexes.conf is updated on all the search peers with the index configuration added on the master node.
9. (Optional) Distribute your apps to all peers and share them across the cluster:
   1. Put /Splunk_TA_ontap in $SPLUNK_HOME$/etc/master-apps/ to distribute on indexers in an indexer cluster environment.
   2. Put /SA-Hydra, /SA-VMNetAppUtils, /Splunk_TA_ontap, and /splunk_app_netapp in $SPLUNK_HOME$/etc/shcluster/apps/ to distribute on search heads in a search head cluster environment.
   3. On the search peers, check that the app files exist under $SPLUNK_HOME/etc/slave-apps/<app_name>.
   4. See the topic How to distribute apps to all peers to learn more.
10. When you have installed the app on the search head node, master node, and search peers and you have set up the cluster, follow the instruction in [Documentation:AddOns:netapp:Setup:released|"Create a data collection node"]] described in the setup section of the Splunk Add-on for NetApp ONTAP.
11. Data collection nodes are managed by the scheduler, on the master node. Log in to Splunk Web and navigate to the Collection Configuration dashboard. Register all new data collection nodes individually with the scheduler, specify the associated filers, and have them forward data to the indexers, then start the scheduler. See the [Documentation:AddOns:netapp:Setup:released|"Create a data collection node"]] described in the setup section of the Splunk Add-on for NetApp ONTAP.
12. Log in to the data collection nodes and check that data is being forwarded to the indexers in the cluster.
13. When you have installed and configured the app in your environment, you can log in to Splunk Web on the search head to view the Splunk App for NetApp Data ONTAP dashboards and use the app.

Sharing apps in a cluster

The master node distributes new or edited configuration files or apps across all the peers. Follow the instructions in the topic "Update common peer configurations and apps" to share apps in a cluster.

For example, to share a saved search across the peer nodes, add the saved search to $SPLUNK_HOME/etc/master-apps/<app-name>/.

Update the savedsearches.conf file. Log in to Splunk Web on the cluster master and push the configuration bundle. You can see the apps in $SPLUNK_HOME/etc/slave-apps/<app-name>/.

Managing configuration changes

Once the Splunk App for NetApp Data ONTAP has been distributed to the set of peers, you launch and manage it on each peer with Splunk Web. See "Managing app configurations and properties" in the Admin Manual.