Splunk® App for NetApp Data ONTAP (Legacy)

Deploy and Use the Splunk App for NetApp Data ONTAP

On June 10, 2021, the Splunk App for NetApp Data ONTAP will reach its end of life and Splunk will no longer maintain or develop this product.

Install Splunk App for NetApp Data ONTAP

Download Splunk App for NetApp Data ONTAP, from Splunkbase and verify that the download package file name is splunk-app-for-netapp-data-ontap_<number>.tgz.

Distributed installation

Use the tables below to determine where and how to install the Splunk App for NetApp Data ONTAP in a distributed deployment of Splunk Enterprise.

Splunk instance type Supported Comments
Search Heads Yes Install this app to all search heads where NetApp knowledge management is required.
Indexers No Install the Splunk Add-on for NetApp Data ONTAP on indexers to monitor NetApp data output.
Forwarders No Install the Splunk Add-on for NetApp Data ONTAP on forwarders to monitor NetApp syslog output.

Distributed deployment compatibility

This table provides a quick reference for the compatibility of the Splunk App for NetApp ONTAP with Splunk distributed deployment features.

Distributed deployment feature Supported Comments
Search Head Clusters Yes Learn about NetApp cluster configuration.
Indexer Clusters No Install the Splunk Add-on for NetApp Data ONTAP onto your cluster master to deploy the Splunk Add-on for NetApp Data ONTAP packages.
Deployment Server No If you use a deployment server, install the Splunk Add-on for NetApp Data ONTAP onto your deployment servers.

Single instance deployment

A single-instance deployment of Splunk Enterprise contains indexers and search heads on a single host.

1. Move the splunk-app-for-netapp-data-ontap_<number>.tgz file to $SPLUNK_HOME/etc/apps.

2. Extract the app package.

tar -xvf splunk-app-for-netapp-data-ontap_<number>.tgz

3. Verify that all of the installation components exist in the $SPLUNK_HOME/etc/apps folder.

4. Restart your Splunk platform instance.

Distributed deployment

For larger environments where data originates on many machines and where many users need to search the data, you can separate out the functions of indexing and searching. In this type of distributed search deployment, each indexer indexes data and performs searches across its own indexes. A Splunk Enterprise instance dedicated to search management, called the search head, coordinates searches across the set of indexers, consolidating the results and presenting them to the user. For more information about distributed search, see About distributed search in the Distributed search manual.

In a distributed search environment:

  1. Get the file splunk-app-for-netapp-data-ontap_<number>.tgz and put it in $SPLUNK_HOME/etc/apps on your search head.
  2. In $SPLUNK_HOME/etc/apps extract the app package.
    tar -xvf splunk-app-for-netapp-data-ontap_<number>.tgz
  3. Verify that splunk_app_netapp/… was copied correctly and resides in $SPLUNK_HOME/etc/apps:
  4. Restart Splunk in each of the locations where you installed the app. For both Windows and Unix instructions, see "Start and stop Splunk" in the Splunk Admin Manual.

Search head cluster environment

Version 2.1.0 and later of the Splunk App for NetApp Data ONTAP supports search head clustering environments. Perform the steps in this topic to set up NetApp Data ONTAP in a search head cluster (SHC) deployment. This configuration improves the overall performance of the Splunk app NetApp Data ONTAP.

NetAppSHC.png

For an overview of search head clustering, see "Search head clustering architecture" in the Splunk Enterprise Distributed Search Manual.

Prerequisites

The Splunk App for NetApp Data ONTAP requires the following:

  • A licensed version of Splunk Enterprise installed and running in your environment
  • You have access to the NetApp Data ONTAP app and permission to install it.

For search head clustering, complete the following requirements:

  • You need a minimum of 3 instances of Splunk Enterprise to serve as search head cluster members, and one additional instance that serves as a deployer, which you use to distribute apps and updated configurations to the cluster members.
  • Each search head cluster member should be a new Splunk platform installation and not a re-purposed Splunk platform instance.
  • You have migrated your settings from a search head pool to a search head cluster. For more information, see Migrate from a search head pool to a search head cluster in the "Splunk Enterprise Distributed Search Manual".
  • The data collection node (DCN) scheduler must be deployed on a dedicated search head, and not on any individual search head in the SHC.

Install your Search head cluster

Search head clustering is supported by version 2.1.0 and later of the Splunk App for NetApp Data ONTAP.

See Deploy a search head cluster in the "Splunk Enterprise Distributed Search Manual" for more information on how to install, configure and deploy a search head cluster.

Install and Deploy the Splunk App for NetApp Data ONTAP in your search head cluster

Follow the steps below to download, install and deploy the Splunk App for NetApp Data ONTAP onto your search head cluster. You must use the search head cluster deployer to distribute your configurations across your set of search head cluster members. See "Use the deployer to distribute apps and configuration updates" in the Splunk Enterprise Distributed Search Manual.

  1. Take the file splunk-app-for-netapp-data-ontap_<number>.tgz that you downloaded from Splunkbase and put it in a temporary directory. This avoids overriding critical files.
    cp splunk-app-for-netapp-data-ontap_<number>.tgz /tmp
  2. Change to the /tmp directory, and extract the app package.
    cd /tmp
    tar -xvf splunk-app-for-netapp-data-ontap_<number>.tgz
  3. Copy the unzipped files and move into your deployer's apps folder inside the shcluster folder.
    cp -r /tmp/* $SPLUNK_HOME/etc/shcluster/apps/
  4. Verify that splunk_app_netapp/… was copied correctly and reside in the $SPLUNK_HOME/etc/shcluster/apps folder.
  5. On your deployer, deploy the NetApp Data ONTAP app onto any member of your SHC.
    ./splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>
  6. Restart Splunk in each of the locations where you installed the app. For both Windows and Unix instructions, see "Start and stop Splunk" in the Splunk Admin Manual.

    Configure user roles

    There are two default user roles defined in the Splunk Add-on for NetApp Data ONTAP and the Splunk App for NetApp Data ONTAP:

    • The splunk_ontap_admin role: This role gives you permission to configure the Splunk Add-on for NetApp Data ONTAP for data collection.
    • The splunk_ontap_user role: This role gives you permission to use the add-on. It does not give you permission to configure the add-on.

    Configure roles for the users of the add-on on the following components:

    • Scheduler (If using a separate scheduler)
    • Search head (or the combined indexer and search head)

    Assign roles to each user

    1. Log in to Splunk Web and enter the IP address and port number of the OS hosting your search head and/or scheduler:
      http://<ipaddress>:8000/
    2. Select the Splunk Add-on for NetApp Data ONTAP from the Apps menu, and navigate to the Collection Configuration page. If this is your first time installing the app, then you are automatically redirected to the Setup page. Accept all of the default settings on the Setup screen, then click Save. For most installations the default settings work.
    3. In Settings, select Users and authentication: Access controls, then select Users.
    4. Give the admin user the splunk_ontap_admin role so that the admin can run scheduled searches. Add splunk_ontap_admin to the "admin" account.
    5. Provide admin_all_objects capability to the splunk_ontap_admin role.
      1. Go to the Settings > Access controls > Roles > splunk_ontap_admin.
      2. Add admin_all_objects capability.
      3. Click Save.

    See the Splunk Add-on for NetApp Data ONTAP installation documentation for add-on installation and data collection node configuration steps.

Last modified on 03 March, 2021
Requirements for installing Splunk App for NetApp Data ONTAP with other apps   Configure data collection

This documentation applies to the following versions of Splunk® App for NetApp Data ONTAP (Legacy): 2.1.91


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters