topic Re: Splunk App for NetApp source VolumePerfHandler has no data in Reporting

Splunk App for NetApp source VolumePerfHandler has no data

xingsd163 — Wed, 29 Oct 2014 09:25:37 GMT

Hello, everyone!

I installed Splunk App for NetApp 2.0.1 on Splunk Enterprise 6.1.3. Everything is OK except that some reports related with volume have no data. I edited these panels and viewed search statements, and found these reports are related with a source: source=VolumePerfHandler. I found no this source in the ontap index.

These reports are not shown:

Proactive Monitoring -> Volume Detail -> Selected Volume Latency (ms)
Proactive Monitoring -> Volume Detail -> Data Transfer Rates (B/s)
Proactive Monitoring -> Volume Detail -> IOPS
Proactive Monitoring -> Volume Detail -> Number of Block Operations Per Second

All of them include statements like:

sourcetype=ontap:perf source=VolumePerfHandler

And, I found these is no data under index=ontap source=VolumePerfHandler.

Note: NetApp is in 7-mode.

Any advice is greaely appreciated.

Thanks in advance.

Re: Splunk App for NetApp source VolumePerfHandler has no data

kml_uvce — Wed, 29 Oct 2014 12:32:28 GMT

This app https://apps.splunk.com/app/1293/ only support netapp 8.x and above so could be this reason its not giving proper report.

Re: Splunk App for NetApp source VolumePerfHandler has no data

halr9000 — Wed, 29 Oct 2014 17:53:07 GMT

What version of DOT are you running? Note that C-mode and 7-mode are distinct from the DOT version. The minimum supported DOT version is 8.0.2 as per the docs.

Re: Splunk App for NetApp source VolumePerfHandler has no data

bkondakindi — Wed, 29 Oct 2014 18:19:37 GMT

i have setup netapp node
few things you can cross verify.
data collector node info.
syslog enabled
index is created .
searches had proper conf settings.

Re: Splunk App for NetApp source VolumePerfHandler has no data

halr9000 — Wed, 29 Oct 2014 19:31:08 GMT

Hi, please note that to get the best out of the Answers website, you'll want to use it as a Q&A site, not a forum. Only create new answers if you actually are answering the original question. Otherwise, use the "add comment" or "reply" links.

Re: Splunk App for NetApp source VolumePerfHandler has no data

xingsd163 — Thu, 30 Oct 2014 01:21:53 GMT

Hi, thanks for your answer.
the NetApp version we are using is NetApp Release 8.1RC2 7-Mode. It is supported as per the docs.

Re: Splunk App for NetApp source VolumePerfHandler has no data

xingsd163 — Thu, 30 Oct 2014 01:25:31 GMT

Is it possible that NetApp does not have volume data generated?

Re: Splunk App for NetApp source VolumePerfHandler has no data

xingsd163 — Thu, 30 Oct 2014 03:05:50 GMT

Note 2: I am using the root user for NetApp to collect API data. Should I create a new user for all privileges??

Re: Splunk App for NetApp source VolumePerfHandler has no data

bboe — Mon, 28 Sep 2020 17:59:08 GMT

It's hard to tell without looking at your environment. I would take a look at the logs splunk is generating to see what kind of errors they're generating. Here are the places that would be good to start with are any logs starting with hydra_* (from the app SA-Hydra) and with ta_ontap* - search for errors within there.

From your initial problem statement, it seems that you just aren't receiving any data for just the volumes. For this I would suggest that you download zexplore from netapp, and with that, check to see if you can get the volume perf data from the filer using their api (they should have documentation here to show you how to do that). If you can use that tool, check and see what the log messages are. There might be an issue with data collection with that particular source.,It's hard to tell without looking at your environment. I would take a look at the logs splunk is generating to see what kind of errors they're generating. Here are the places that would be good to start with are any logs starting with hydra_* (from the app SA-Hydra) and with ta_ontap* - search for errors within there.

Re: Splunk App for NetApp source VolumePerfHandler has no data

xingsd163 — Tue, 11 Nov 2014 08:40:30 GMT

thanks very much, i will try !