Does the EMC XtremIO Add-on for Splunk Enterprise work for a deployment of multiple XIO arrays from one Console?

[mrulf]

I recently consolidated all of my XIO arrays to one console. Once that was done, I can no longer see volume information for any of the arrays. Do you know if the Add-on works for this deployment architecture?

Thanks,

Mike

[pjvarjani]

Hi Mike,

EMC XtremIO Add-on works with multiple XIO Clusters.Can you run the following search and check whether volume data is there or not:

index=main sourcetype=emc:xtremio:rest component=volumes

Thanks,
Pankaj

[mrulf]

It stopped collecting when we consolidated the arrays to one console. In looking @ the REST API calls, I see that when a console manages more than one array that you are required to pass an ClusterID to obtain volume information. Here is an example of the original REST call which now generates an error:

curl -k https://user:pass@array01.acme.com/api/json/types/volumes/62951
{
"message": "cluster_id_is_required",
"error_code": 400

Instead you must now pass the cluster name so the request now becomes:

curl -k https://user:pass@xioconsole.acme.com/api/json/types/volumes/62951?cluster-name=array01

This revised call returns all the REST properties for the volume.

Best,

Mike