Dell EMC VMAX Add-on for Splunk: How to duplicate the add-on to monitor an additional VMAX array?

[Kendo213]

In this case I'm using the Dell EMC VMAX Add-on for Splunk (TA_Dell_VMAX) to monitor an array. It only allows for one IP to be specified, and we have an additional VMAX array that needs to be monitored. How can I go about duplicating this add-on on my search head so I can monitor both arrays? Is this even possible?

[MichaelMcAleer · Accepted solution]

Hi There,

Firstly let me apologise for the delay in my response, Friday was a public holiday so I am only getting back to work again this morning.

Multiple arrays from the same instance of Unisphere can be added to Splunk using the 'Data Inputs' section of Splunk settings. Under the input category 'Dell EMC VMAX REST' you can add each array individually by the numerical array ID, this can be repeated for as many VMAX Hybrid & All-Flash systems as required.

If you have multiple arrays spread across multiple instances of Unisphere, there is reference to distributed environments within the VMAX add-on documentation. In a distributed deployment, install the Splunk VMAX TA to your search heads and heavy forwarders. This TA does not support universal forwarders because the TA requires Python. The add-on does not need to be installed on indexers because it does not support universal forwarders or light forwarders, thus parsing occurs on the heavy forwarder rather than on indexers. A search head/heavy forwarder per instance of Unisphere will allow you to forward data from all your instances of Unisphere.

For a detailed installation instructions, refer to "Installing add-ons" that describes how to install a Splunk add-on in the following deployment scenarios:
• single-instance Splunk Enterprise
• distributed Splunk Enterprise
• Splunk Cloud
• Splunk Light

Thank you for your question, if you have any further questions, recommendations, or feedback concerning the VMAX add-on for Splunk, please do not hesitate to ask questions either here on Splunk Answers or via our direct support e-mail address vmax.splunk.support@emc.com.

Michael

[Kendo213]

Michael,

Thanks for the response. I have added the additional SID in the data input, however it states that no arrays are found, and also that performance statistics need to be registered for the remote array according to the log files. The array has been registered for performance, as it works if I use the Unipshere IP for that array.

I misunderstood your response. It looks like I need to deploy another search head / heavy forwarder.

Thanks!

Jerad

[MichaelMcAleer]

Hi Jerad,

The VMAX Array ID is the 12 digit numerical ID ie '000197222222', if this array is registered for performance data collection in Unisphere there should be no issues. If the array was only just registered you will have to wait a few hours before the array is ready to start reporting.

If you like, you can e-mail at vmax.splunk.support@emc.com and we will be better able to help with your specific environment, and if possible a copy of the VMAX related logs from Splunk along with environment details i.e. VMAX type, array ID etc.

Thanks!
Michael

[Kendo213]

Michael,

Thanks for the quick response. I e-mailed you at that e-mail address with more details.

Thanks!

Jerad

[MichaelMcAleer]

Hi Jerad,

Could you please send a copy of that e-mail to Michael.Mcaleer@emc.com? The support alias is not functioning correctly at present, I will also update the support e-mail address on the add-on page to avoid any further confusion.

Apologies for any inconvenience caused!
Michael

[Kendo213]

I've sent a copy to that e-mail.

Thanks!