topic Re: How to get NetApp logs into Splunk in All Apps and Add-ons

How to get NetApp logs into Splunk

blasighb — Wed, 11 Sep 2013 21:28:44 GMT

Installed Splunk within environment, and wanted to forward all NetApp logs into SPLUNK Indexer. Current set up is Splunk Search head and Indexer on same box, one syslog server that is being indexed. Would like a step by step to forward logs from NetApp to Splunk.

Re: How to get NetApp logs into Splunk

sdaniels — Wed, 11 Sep 2013 22:12:59 GMT

There is a documentation tab on the App website. If you run into issues after following those steps feel free to post a question.

http://apps.splunk.com/app/1293

Re: How to get NetApp logs into Splunk

halr9000 — Thu, 12 Sep 2013 05:05:47 GMT

What @sdaniels said, but if the only thing you are interested in are the actual system logs (and not performance or configuration data, which the app provides in addition), then you can certainly do syslog forwarding. On NetApp 7-mode, it works exactly like any unix, i.e. 'man syslogd.conf'. Here's a blog post with some instructions: http://networkadminkb.com/KB/a455/how-to-configure-a-netapp-fas-to-forward-syslog-messages.aspx

Cluster-mode is different. You would use the 'event' command while logged into a command shell. ONTAP 8.1 reference guide link [may require login to view]: https://library.netapp.com/ecmdocs/ECMP1120736/html/event/destination/modify.html

Re: How to get NetApp logs into Splunk

sudovicic_splun — Sat, 15 Feb 2014 00:14:31 GMT

For details on how to get logs, performance and configuration data from NetApp ONTAP environment, please refer to Splunk App for NetApp Data ONTAP docs:

http://docs.splunk.com/Documentation/NetApp/2.0/DeployNetapp/Configuredatacollection

Re: How to get NetApp logs into Splunk

gertux — Wed, 19 Feb 2014 16:44:49 GMT

Hi i had an issue with the NetApp plugin, i've already configured and installed and also add the cluster mode array with the IP address and credentials validated. Also i run the Scheduler, but when i go to the "Proactive Monitoring" and then for example to the "Cluster View" i'm getting the following message "Search query is not fully resolved.", and nothing is displayed. Could someone help me out with this since i'd like to try Splunk to monitor our Filers from NetApp.

Thanks in advance,

Best regards to all

Re: How to get NetApp logs into Splunk

bboe — Thu, 20 Feb 2014 20:01:49 GMT

There could be a couple different causes to this issue. One is that the tsidx searches did not finish populating their indexes before the page was loaded. This issue will resolve itself over time.

First, it might be helpful to check that you're getting data. By default, data goes into index=ontap. If this index is empty, then there's a problem with your configuration. Check that your data collection node is configured as a forwarder and sending data to your indexer. If you're not seeing data in index=_internal from the data collection node host, then there's a connection problem that needs resolution.

If you're still seeing the same issues, check index=_internal sourcetype=splunk_ta_ontap_api* OR sourcetype=hydra* ERROR for any errors during collection.

Re: How to get NetApp logs into Splunk

hitesh_kanchan — Thu, 11 Jun 2015 16:43:53 GMT

I am facing a similar issue where I am not able to see any data. Just wanted to confirm on the settings that I did.

I have a Splunk server which is configured as a SearchHead and Indexer. Installed the Netapp App on that.
On this server, I added a OntapServer by clicking on the "Add Ontap Collection" button. Is that fine.

I have not setup any Data Collection Node. Is it mandatory to set up one?

I don't see anything in index=_internal host=someHost.