Splunk® App for NetApp Data ONTAP (Legacy)

Deploy and Use the Splunk App for NetApp Data ONTAP

On June 10, 2021, the Splunk App for NetApp Data ONTAP will reach its end of life and Splunk will no longer maintain or develop this product.

Configure data models

Version 2.1.0 of the Splunk App for NetApp Data ONTAP replaces the use of tsidx namespacing with the use of data models and data model acceleration. Existing tsidx files will be not be deleted after the upgrade, and will continue to work after the upgrade to version 2.1.0 of the Splunk App for NetApp Data ONTAP once data model acceleration is configured (see below).

See About data models to learn more.

Tsidx scheduling and storage was done on the search head. Data model acceleration is distributed across your indexers. Spreading this task across your indexers instead of your search head leads to faster searches across your installation.

Data model acceleration speeds up reporting for the entire set of attributes (fields) that you define in a data model. Data model acceleration creates summaries for the specific set of fields you and your Pivot users want to report on, accelerating the dataset represented by that collection of fields rather than a particular search against that dataset. Data that has not been accelerated yet (for example, live streaming data) will still be captured in queries by falling back to normal search for that data. Splunk Enterprise always process all summaries first, so accelerated data arrives faster. It may take a few hours to create the data model acceleration depending on the amount of data that is historically indexed.

Index storage size on your NetApp indexes will remain unchanged with the implementation of data model acceleration. Data model acceleration has a 7 day retention policy, and does not have a set size retention policy. With the upgrade to 2.1, data model acceleration summaries can, by default, take up an unlimited amount of disk space.

Click here to learn more about how to configure index size.

Your deployment's Data Model properties are located in datamodels.conf on your indexers. See "Data collection configuration file reference" to see the datamodels.conf default configuration.

Data that has not been accelerated yet (for example, live streaming data) will still be captured in queries by falling back to normal search for that data. Splunk Enterprise always process all summaries first, so accelerated data arrives faster.

See Accelerate data models to learn more.

To map tsidx namespaces to data model nodes, click here to learn more.

Last modified on 03 April, 2017
Configure a cluster deployment   Considerations when using tsidx namespaces

This documentation applies to the following versions of Splunk® App for NetApp Data ONTAP (Legacy): 2.1.6, 2.1.7, 2.1.8, 2.1.91


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters