Configure a cluster deployment

A cluster is a group of of Splunk Enterprise nodes (indexers) configured to replicate each others' data, so that the system keeps multiple copies of all of the data. This process is known as index replication. By maintaining multiple, identical copies of the data, clusters prevent data loss while promoting data availability for searching.

For more information on cluster deployments, see:

• "Key differences between clustered and non-clustered deployments" in the Splunk Enterprise documentation to set up a cluster.
• "The basics of indexer cluster architecture" in the Managing Indexers and Clusters Manual.
• "Back up indexed data" in the Managing Indexers and Clusters Manual.
• "About clusters and index replication" in the "Managing Indexers and Clusters" manual.

Configure a cluster for the Splunk App for NetApp Data ONTAP

The Splunk App for NetApp Data ONTAP requires a stable and supportable Splunk installation.

To set up a cluster environment for the Splunk App for NetApp Data ONTAP:

• Read the topic "Deployment overview". This topic describes the main steps to deploying clusters.
• Follow the instruction in "How to distribute apps to all the peers" to distribute apps across all the peers.

This topic discusses the specific requirements for the Splunk App for NetApp Data ONTAP in a clustered environment.

1. Determine the nodes you want to set up as the master node, peer nodes and search head nodes. Also decide what replication factor you want to implement. The replication factor is the number of copies of raw data that the cluster maintains. It should be less than or equal to the number of search peers (slave nodes).
2. Install the Splunk App for NetApp Data ONTAP on the search head, master nodes, and search peers under the $SPLUNK_HOME/etc/apps directory.
3. Follow the instructions in Deploy a cluster to enable the master node, the peer nodes, and the search head for a clustered environment.
4. Delete SA-VMNetAppUtils, SA-Hydra and Splunk_TA_ontap from the master-apps directory before issuing the 'apply cluster-bundle' command. If SA-VMNetAppUtils is deployed, it will prevent the UI on any indexers from starting up.
5. On the master node, to distribute the configuration bundle to the search peers, log in to Splunk Web or use the CLI. Distribute the bundle in the $SPLUNK_HOME/etc/master-apps directory.
6. (Optional) Distribute your apps to all peers and share them across the cluster:
   1. Put /SA-ONTAPIndex in $SPLUNK_HOME$/etc/master-apps/ to distribute on indexers in an indexer cluster environment.
   2. Put /SA-Hydra, /SA-VMNetAppUtils, /TA-ONTAP-FieldExtractions, and /splunk_app_netapp in $SPLUNK_HOME$/etc/shcluster/apps/ to distribute on search heads in a search head cluster environment.
   3. On the search peers, check that the app files exist under $SPLUNK_HOME/etc/slave-apps/<app_name>.
   4. See the topic How to distribute apps to all peers to learn more.
7. When you have installed the app on the search head node, master node, and search peers and you have set up the cluster, install the Install Splunk Add-on for NetApp Data ONTAP.
8. Data collection nodes are managed by the scheduler, on the master node. Log in to Splunk Web and navigate to the Collection Configuration dashboard. Register all new data collection nodes individually with the scheduler, specify the associated filers, and have them forward data to the indexers, then start the scheduler. See Install Splunk Add-on for NetApp Data ONTAP.
9. Log in to the data collection nodes and check that data is being forwarded to the indexers in the cluster.
10. When you have installed and configured the app in your environment, you can log in to Splunk Web on the search head to view the Splunk App for NetApp Data ONTAP dashboards and use the app.

Sharing apps in a cluster

The master node distributes new or edited configuration files or apps across all the peers. Follow the instructions in the topic "Update common peer configurations and apps" to share apps in a cluster.

For example, to share a saved search across the peer nodes, add the saved search to $SPLUNK_HOME/etc/master-apps/<app-name>/.

Update the savedsearches.conf file. Log in to Splunk Web on the cluster master and push the configuration bundle. You can see the apps in $SPLUNK_HOME/etc/slave-apps/<app-name>/.

Managing configuration changes

Once the Splunk App for NetApp Data ONTAP has been distributed to the set of peers, you launch and manage it on each peer with Splunk Web. See "Managing app configurations and properties" in the Admin Manual.