EMC Isilon Add-on for Splunk Enterprise: Setup multiple clusters?

[amirofmn]

We have successfully configured the EMC Isilon Add-on for Splunk Enterprise in our distributed environment and is currently pulling data from one cluster/site. If we want to add a second cluster/site into the Add-on, do we just enter the information of the second cluster/site in the 'Add any of the Cluster node credentials' page or will that overwrite our current setup?

[pjvarjani · Accepted solution]

Hi,

You can add the second cluster through setup page of Add-on. It would not overwrite the previous configurations. Both EMC Isilon Add-on and App are designed in a such a way that they support multiple Isilon clusters.

Thanks,
Pankaj

[amirofmn]

Thanks for the response. We entered the second cluster/site and it worked!

If we need to remove any old/outdated cluster information from the Add-on, is the best way going to be deleting/disabling all the inputs?

[pjvarjani]

Hi,

Yes you can disable all the inputs for that cluster/node. I would suggest better solution though.

On your Heavy Forwarder/Data collection node,

1. Remove the entry of input stanzas for the unwanted cluster/node from TA_EMC-Isilon/local/inputs.conf(take backup first)
2. remove the stanza for unwanted cluster/node from TA_EMC-Isilon/local/passwords.conf.
3. Restart Splunk

Thanks,
Pankaj