https://community.splunk.com/t5/All-Apps-and-Add-ons/in-source-Systemperfhandler-fields-have-value-Multiple-Values/m-p/234787#M26397 <P>Investigation has shown that 8.3 returns different information to 8.2 - case opened with Splunk and NetApp to resolve.</P> <P>Basic issue - for a cluster, when asked for system objects. 8.2 returned an object per node. 8.3 returns a one cluster object.</P> Mon, 24 Oct 2016 01:20:51 GMT jimmoriarty 2016-10-24T01:20:51Z https://community.splunk.com/t5/All-Apps-and-Add-ons/in-source-Systemperfhandler-fields-have-value-Multiple-Values/m-p/234785#M26395 <P>Why are the below fields for this source literally 'Multiple_Values'? I tracked it down, and it seems only clusters with the OS NetApp Release 8.3.1P1 show this behavior.</P> <P>Is this a bug, or has it a reason?</P> <P>The fields having those values:<BR /> hostname<BR /> node_name<BR /> node_uuid<BR /> serial_no</P> Tue, 29 Sep 2020 08:59:32 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/in-source-Systemperfhandler-fields-have-value-Multiple-Values/m-p/234785#M26395 machiel 2020-09-29T08:59:32Z https://community.splunk.com/t5/All-Apps-and-Add-ons/in-source-Systemperfhandler-fields-have-value-Multiple-Values/m-p/234786#M26396 <P>Also observed on v8.3.2P6</P> Thu, 13 Oct 2016 08:38:01 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/in-source-Systemperfhandler-fields-have-value-Multiple-Values/m-p/234786#M26396 jimmoriarty 2016-10-13T08:38:01Z https://community.splunk.com/t5/All-Apps-and-Add-ons/in-source-Systemperfhandler-fields-have-value-Multiple-Values/m-p/234787#M26397 <P>Investigation has shown that 8.3 returns different information to 8.2 - case opened with Splunk and NetApp to resolve.</P> <P>Basic issue - for a cluster, when asked for system objects. 8.2 returned an object per node. 8.3 returns a one cluster object.</P> Mon, 24 Oct 2016 01:20:51 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/in-source-Systemperfhandler-fields-have-value-Multiple-Values/m-p/234787#M26397 jimmoriarty 2016-10-24T01:20:51Z https://community.splunk.com/t5/All-Apps-and-Add-ons/in-source-Systemperfhandler-fields-have-value-Multiple-Values/m-p/234788#M26398 <P>We also opened a case with NetApp. This party told us that the multiple_values is 'by design'. Any update from your part?</P> Wed, 09 Nov 2016 13:58:08 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/in-source-Systemperfhandler-fields-have-value-Multiple-Values/m-p/234788#M26398 machiel 2016-11-09T13:58:08Z https://community.splunk.com/t5/All-Apps-and-Add-ons/in-source-Systemperfhandler-fields-have-value-Multiple-Values/m-p/234789#M26399 <P>The new version of the Splunk ONTAP apps (2.1.4) did not solve the issue.</P> Wed, 09 Nov 2016 13:58:36 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/in-source-Systemperfhandler-fields-have-value-Multiple-Values/m-p/234789#M26399 machiel 2016-11-09T13:58:36Z https://community.splunk.com/t5/All-Apps-and-Add-ons/in-source-Systemperfhandler-fields-have-value-Multiple-Values/m-p/234790#M26400 <P>Rewrote ./bin/ta_ontap/OntapPerf.py to query system:node instead of system (as held in the objectType parameter), when ontap v8.3+ is detected. Amended OntapClinet.py as well (to manage querying the ontap version). Not a 100% fix, as it appears some of the resulting attributes are different - not a perfect 1:1 match for data structure - but good enough for us.</P> <P>Small print in the hardware and software requirements for the Splunk app do actually note that only up to 8.2 is supported...</P> <P>Splunk App developers have been contacted with details of my workaround.</P> Wed, 09 Nov 2016 14:23:56 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/in-source-Systemperfhandler-fields-have-value-Multiple-Values/m-p/234790#M26400 jimmoriarty 2016-11-09T14:23:56Z