- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- All Apps and Add-ons
- :
- Re: NetApp Data ONTAP: App is indexing events, but...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I installed the Splunk App for NetApp and everything seemed to install fine. Filers and clusters were added and show "valid" connection and credentials. I can also see events being indexed via the "App Data Volume", under "Settings".
However, none of the App dashboards are populating with information. All dashboards show, "No results found."
Can anyone tell me why I am not getting any information on the dashboards?
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
1) add index=* to the start of your search. If that works, note the index that the data you want is in.
2) settings -> roles -> admin -> indexes searched by default. Add the index you want.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My problem is similar but it looks like I do not have a sourcetype of sourcetype=ontap:perf
I do not know why? what would cause that? everything else I think is working fine with the app.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
But that is most of the dashboards right? I set the ontap index to be searched and can search it just fine. I see the info about each filer and when I go into filer view I see the number of CPUs, memory and aggregates but below that where the dashboards are I do not get results. The only dashboard that works is the one that shows the total storage space.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Except for the dashboards that need the "ontap:perf" sourcetype.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry, my mistake. I still don't see a sourcetype of ontap:perf, but the dashboards all seem to function.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you add the index "ontap" to the list of indexes search by default?
I had no soucetype of "ontap:perf" until I added that index.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
1) add index=* to the start of your search. If that works, note the index that the data you want is in.
2) settings -> roles -> admin -> indexes searched by default. Add the index you want.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks! That worked like a charm.
Above answer fixed the problem.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't know. Is there a file I can check to find that info?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
what indexes are searched by default?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It seems that most of the dashboards require the sourcetype ontap:perf and when I do a search on sourcetype=ontap:perf, I get no events returned. My dashboard problem may be related to this, but I don't know how.
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
