What a Splunk App for NetApp Data ONTAP deployment looks like

The Splunk App for NetApp Data ONTAP works with NetApp® Data ONTAP to collect granular performance, log, and event data about the storage layer and bring it into Splunk. You can then use this data and correlate it with other data in your environment.

500px

A Splunk App for NetApp Data ONTAP deployment is made up of Splunk Enterprise components installed on multiple machines with the specific app components installed onto the Splunk platform. Your deployment contains the following components:

• A search head with Splunk version 7.1.0 or later installed on it. Install the Splunk App for NetApp Data ONTAP onto this instance and use Splunk Web to navigate the dashboards. The app contains the UI components, searches, and indexing definitions for your NetApp filer data. This system receives the data from the other components. The scheduled searches that ship with the app are run from the search head to the indexers. The data retrieved is returned to the search head, and either stored there for later use, or displayed in the app. The scheduler is run on the search head orchestrating API data collection with the data collection nodes.
• Indexers with Splunk version 7.1.0 or later installed. Install the SA-ONTAPIndex onto this instance.
• One or more data collection nodes with network access to your NetApp filers and clusters, and access to the search head on which the scheduler is installed. Install Splunk_TA_ontap here.
• NetApp filers sending logs to Splunk intermediate forwarders and then forwarding that data to your indexers.

App component distribution

Use the following table when installing the app into your environment. It shows what apps are required and where to install them.

Component	Search Head	Data Collection Node	Indexer	Scheduler
Splunk_TA_ontap		X		X
splunk_app_netapp	X
SA-Hydra	X	X		X
SA-VMNetAppUtils	X	X		X
SA-ONTAPIndex			X
TA-ONTAP-FieldExtractions	X

Component Distribution Notes

Component name	Description
Scheduler	Install the Splunk_TA_ontap, SA-Hydra and SA-VMNetAppUtils on your scheduler.
Search head	If you have a dedicated search head, install all of the app components and required TA components on it.
Indexer	Install SA-ONTAPIndex on an indexer.
Data Collection Node	The data collection node needs the API data collection component installed on it, Splunk_TA_ontap (the python based collection engine). Due to the requirement of Python, universal forwarders cannot be used.
NetApp filers	NetApp Data ONTAP uses the syslogd daemon to log system messages for the filers (and uses the configuration file /etc/syslog.conf). Forward syslog to the Splunk indexer.

App components

Component name	Description
Splunk App for NetApp Data ONTAP	The Splunk App for NetApp Data ONTAP contains the UI components of the App. Install it on the search heads in your environment. splunk_app_netapp
Splunk Add-on for NetApp Data ONTAP (Splunk_TA_ontap)	The Splunk Add-on for NetApp Data ONTAP contains the knowledge objects of your Splunk App for NetApp Data ONTAP deployment. SA-VMNetAppUtils SA-Hydra Splunk_TA_ontap TA-ONTAP-FieldExtractions TA-ONTAPIndex

Use the Splunk Add-on for NetApp Data ONTAP to:

• Make API calls to your NetApp filers to collect API data and forwards that data to your Splunk indexer/search head. This data includes performance, inventory, options, and EMS event data.
• Create your own data collection node (DCN). Install it on a Splunk light forwarder or heavy forwarder on your data collection node. The data collection node does not collect system log data.