All Apps and Add-ons

NetApp Data ONTAP: App is indexing events, but no information is appearing in dashboards.

Bill_B
Communicator

I installed the Splunk App for NetApp and everything seemed to install fine. Filers and clusters were added and show "valid" connection and credentials. I can also see events being indexed via the "App Data Volume", under "Settings".
However, none of the App dashboards are populating with information. All dashboards show, "No results found."
Can anyone tell me why I am not getting any information on the dashboards?

Thanks.

1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

1) add index=* to the start of your search. If that works, note the index that the data you want is in.
2) settings -> roles -> admin -> indexes searched by default. Add the index you want.

View solution in original post

johns3
Path Finder

My problem is similar but it looks like I do not have a sourcetype of sourcetype=ontap:perf

I do not know why? what would cause that? everything else I think is working fine with the app.

0 Karma

johns3
Path Finder

But that is most of the dashboards right? I set the ontap index to be searched and can search it just fine. I see the info about each filer and when I go into filer view I see the number of CPUs, memory and aggregates but below that where the dashboards are I do not get results. The only dashboard that works is the one that shows the total storage space.

0 Karma

Bill_B
Communicator

Except for the dashboards that need the "ontap:perf" sourcetype.

0 Karma

Bill_B
Communicator

Sorry, my mistake. I still don't see a sourcetype of ontap:perf, but the dashboards all seem to function.

0 Karma

Bill_B
Communicator

Did you add the index "ontap" to the list of indexes search by default?
I had no soucetype of "ontap:perf" until I added that index.

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

1) add index=* to the start of your search. If that works, note the index that the data you want is in.
2) settings -> roles -> admin -> indexes searched by default. Add the index you want.

Bill_B
Communicator

Thanks! That worked like a charm.
Above answer fixed the problem.

0 Karma

Bill_B
Communicator

I don't know. Is there a file I can check to find that info?

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

what indexes are searched by default?

0 Karma

Bill_B
Communicator

It seems that most of the dashboards require the sourcetype ontap:perf and when I do a search on sourcetype=ontap:perf, I get no events returned. My dashboard problem may be related to this, but I don't know how.

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...