Splunk® App for NetApp Data ONTAP (Legacy)

Deploy and Use the Splunk App for NetApp Data ONTAP

On June 10, 2021, the Splunk App for NetApp Data ONTAP will reach its end of life and Splunk will no longer maintain or develop this product.

What a Splunk App for NetApp Data ONTAP deployment looks like

The Splunk App for NetApp Data ONTAP works with NetApp® Data ONTAP to collect granular performance, log, and event data about the storage layer and bring it into Splunk. You can then use this data and correlate it with other data in your environment.

500px

A Splunk App for NetApp Data ONTAP deployment is made up of Splunk Enterprise components installed on multiple machines with the specific app components installed onto the Splunk platform. Your deployment contains the following components:

  • A search head with Splunk version 7.1.0 or later installed on it. Install the Splunk App for NetApp Data ONTAP onto this instance and use Splunk Web to navigate the dashboards. The app contains the UI components, searches, and indexing definitions for your NetApp filer data. This system receives the data from the other components. The scheduled searches that ship with the app are run from the search head to the indexers. The data retrieved is returned to the search head, and either stored there for later use, or displayed in the app. The scheduler is run on the search head orchestrating API data collection with the data collection nodes.
  • Indexers with Splunk version 7.1.0 or later installed. Install the SA-ONTAPIndex onto this instance.
  • One or more data collection nodes with network access to your NetApp filers and clusters, and access to the search head on which the scheduler is installed. Install Splunk_TA_ontap here.
  • NetApp filers sending logs to Splunk intermediate forwarders and then forwarding that data to your indexers.

App component distribution

Use the following table when installing the app into your environment. It shows what apps are required and where to install them.


Component Search Head Data Collection Node Indexer Scheduler
Splunk_TA_ontap X X
splunk_app_netapp X
SA-Hydra X X X
SA-VMNetAppUtils X X X
SA-ONTAPIndex X
TA-ONTAP-FieldExtractions X

Component Distribution Notes

Component name Description
Scheduler Install the Splunk_TA_ontap, SA-Hydra and SA-VMNetAppUtils on your scheduler.
Search head If you have a dedicated search head, install all of the app components and required TA components on it.
Indexer Install SA-ONTAPIndex on an indexer.
Data Collection Node The data collection node needs the API data collection component installed on it, Splunk_TA_ontap (the python based collection engine). Due to the requirement of Python, universal forwarders cannot be used.
NetApp filers NetApp Data ONTAP uses the syslogd daemon to log system messages for the filers (and uses the configuration file /etc/syslog.conf). Forward syslog to the Splunk indexer.

App components

Component name Description
Splunk App for NetApp Data ONTAP The Splunk App for NetApp Data ONTAP contains the UI components of the App. Install it on the search heads in your environment.
  • splunk_app_netapp
Splunk Add-on for NetApp Data ONTAP (Splunk_TA_ontap) The Splunk Add-on for NetApp Data ONTAP contains the knowledge objects of your Splunk App for NetApp Data ONTAP deployment.
  • SA-VMNetAppUtils
  • SA-Hydra
  • Splunk_TA_ontap
  • TA-ONTAP-FieldExtractions
  • TA-ONTAPIndex

Use the Splunk Add-on for NetApp Data ONTAP to:

  • Make API calls to your NetApp filers to collect API data and forwards that data to your Splunk indexer/search head. This data includes performance, inventory, options, and EMS event data.
  • Create your own data collection node (DCN). Install it on a Splunk light forwarder or heavy forwarder on your data collection node. The data collection node does not collect system log data.
Last modified on 06 May, 2019
Other deployment considerations   Requirements for installing Splunk App for NetApp Data ONTAP with other apps

This documentation applies to the following versions of Splunk® App for NetApp Data ONTAP (Legacy): 2.1.91


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters