Splunk App for NetApp source VolumePerfHandler has no data

[xingsd163]

Hello, everyone!

I installed Splunk App for NetApp 2.0.1 on Splunk Enterprise 6.1.3. Everything is OK except that some reports related with volume have no data. I edited these panels and viewed search statements, and found these reports are related with a source: source=VolumePerfHandler. I found no this source in the ontap index.

These reports are not shown:

Proactive Monitoring -> Volume Detail -> Selected Volume Latency (ms)
Proactive Monitoring -> Volume Detail -> Data Transfer Rates (B/s)
Proactive Monitoring -> Volume Detail -> IOPS
Proactive Monitoring -> Volume Detail -> Number of Block Operations Per Second

All of them include statements like:

sourcetype=ontap:perf source=VolumePerfHandler

And, I found these is no data under index=ontap source=VolumePerfHandler.

Note: NetApp is in 7-mode.

Any advice is greaely appreciated.

Thanks in advance.

[bboe · Accepted solution]

It's hard to tell without looking at your environment. I would take a look at the logs splunk is generating to see what kind of errors they're generating. Here are the places that would be good to start with are any logs starting with hydra_* (from the app SA-Hydra) and with ta_ontap* - search for errors within there.

From your initial problem statement, it seems that you just aren't receiving any data for just the volumes. For this I would suggest that you download zexplore from netapp, and with that, check to see if you can get the volume perf data from the filer using their api (they should have documentation here to show you how to do that). If you can use that tool, check and see what the log messages are. There might be an issue with data collection with that particular source.,It's hard to tell without looking at your environment. I would take a look at the logs splunk is generating to see what kind of errors they're generating. Here are the places that would be good to start with are any logs starting with hydra_* (from the app SA-Hydra) and with ta_ontap* - search for errors within there.

From your initial problem statement, it seems that you just aren't receiving any data for just the volumes. For this I would suggest that you download zexplore from netapp, and with that, check to see if you can get the volume perf data from the filer using their api (they should have documentation here to show you how to do that).

[xingsd163]

thanks very much, i will try !

[xingsd163]

Note 2: I am using the root user for NetApp to collect API data. Should I create a new user for all privileges??

[xingsd163]

Is it possible that NetApp does not have volume data generated?

[kml_uvce]

This app https://apps.splunk.com/app/1293/ only support netapp 8.x and above so could be this reason its not giving proper report.

[xingsd163]

Hi, thanks for your answer.
the NetApp version we are using is NetApp Release 8.1RC2 7-Mode. It is supported as per the docs.

[bkondakindi]

i have setup netapp node
few things you can cross verify.
data collector node info.
syslog enabled
index is created .
searches had proper conf settings.

[halr9000]

Hi, please note that to get the best out of the Answers website, you'll want to use it as a Q&A site, not a forum. Only create new answers if you actually are answering the original question. Otherwise, use the "add comment" or "reply" links.

[halr9000]

What version of DOT are you running? Note that C-mode and 7-mode are distinct from the DOT version. The minimum supported DOT version is 8.0.2 as per the docs.