What a Splunk App for NetApp Data ONTAP deployment looks like
The Splunk App for NetApp Data ONTAP works with NetApp® Data ONTAP to collect granular performance, log, and event data about the storage layer and bring it into Splunk. You can then use this data and correlate it with other data in your environment.
A Splunk App for NetApp Data ONTAP deployment is made up of Splunk Enterprise components installed on multiple machines with the specific app components installed onto the Splunk platform. Your deployment contains the following components:
- A search head with Splunk version 7.1.0 or later installed on it. Install the Splunk App for NetApp Data ONTAP onto this instance and use Splunk Web to navigate the dashboards. The app contains the UI components, searches, and indexing definitions for your NetApp filer data. This system receives the data from the other components. The scheduled searches that ship with the app are run from the search head to the indexers. The data retrieved is returned to the search head, and either stored there for later use, or displayed in the app. The scheduler is run on the search head orchestrating API data collection with the data collection nodes.
- Indexers with Splunk version 7.1.0 or later installed. Install the SA-ONTAPIndex onto this instance.
- One or more data collection nodes with network access to your NetApp filers and clusters, and access to the search head on which the scheduler is installed. Install Splunk_TA_ontap here.
- NetApp filers sending logs to Splunk intermediate forwarders and then forwarding that data to your indexers.
App component distribution
Use the following table when installing the app into your environment. It shows what apps are required and where to install them.
|Component||Search Head||Data Collection Node||Indexer||Scheduler|
Component Distribution Notes
|Scheduler||Install the |
|Search head||If you have a dedicated search head, install all of the app components and required TA components on it.|
|Indexer||Install SA-ONTAPIndex on an indexer.|
|Data Collection Node||The data collection node needs the API data collection component installed on it, |
|NetApp filers||NetApp Data ONTAP uses the syslogd daemon to log system messages for the filers (and uses the configuration file |
|Splunk App for NetApp Data ONTAP||The Splunk App for NetApp Data ONTAP contains the UI components of the App. Install it on the search heads in your environment.
|Splunk Add-on for NetApp Data ONTAP (Splunk_TA_ontap)||The Splunk Add-on for NetApp Data ONTAP contains the knowledge objects of your Splunk App for NetApp Data ONTAP deployment.
Use the Splunk Add-on for NetApp Data ONTAP to:
- Make API calls to your NetApp filers to collect API data and forwards that data to your Splunk indexer/search head. This data includes performance, inventory, options, and EMS event data.
- Create your own data collection node (DCN). Install it on a Splunk light forwarder or heavy forwarder on your data collection node. The data collection node does not collect system log data.
Other deployment considerations
Requirements for installing Splunk App for NetApp Data ONTAP with other apps
This documentation applies to the following versions of Splunk® App for NetApp Data ONTAP (Legacy): 2.1.91