Also, the fact that you're on OneFS v7.x is also likely to be the explanation for why you're not seeing the Node Events info you mentioned. The event-related PAPI endpoints (https:.../3/event/eventlists...) that you see in local/inputs.conf don't exist in v7.x; they, too, appear in v8.x. But if you don't mind changing ${SPLUNK_HOME}/etc/apps/TA_EMC-Isilon/local/inputs.conf even further, you might want to try editing the clause(s) that refer to "/3/event/eventlists" to be "/2/event/events/" instead. I can't guarantee that this'll solve your problem, but it's what I would try, if I were you and if I really wanted to see event data. Again, good luck! ... View more

I suspect that your cluster is running version 7.x of OneFS, where neither of those PAPI endpoints are defined. They weren't added until v8.x. So, if you can't stand having those log entries appear, then edit ${SPLUNK_HOME}/etc/apps/TA_EMC-Isilon/local/inputs.conf and delete or comment-out each the [isilon://...] clauses that refer to those endpoints; there should be one clause per endpoint per cluster. Then, restart Splunk. At least, that's what I'd do if I really wanted to eliminate those log entries. Of course, another way to get rid of those errors would be to upgrade your cluster to OneFS v8.x. But that's a slightly more complicated solution. 🙂 Good luck! --Mark ... View more

First off, if you haven't by now, I would add this to TA_EMC-isilon/local/app.conf: is_configured = 1 Several other folks have indicated that they had to do this to get the app to work correctly. But even after I did that, it continued to fail. I looked in /opt/splunk/var/log/isilon/emc_isilon.log, and found several occurrences of this error msg: 2018-02-07 09:40:46,904 ERROR 140461065750272 - EMC Isilon Error: index isilon does not exist i looked under Settings > Indexes, and sure enough, there isn't one there. So, this app doesn't appear to create the necessary index. I created the "isilon" index, flagged it as relating to the "EMC Isilon App for Splunk Enterprise" app, and bingo I was able to add an entry from the "Add any of the Cluster node credentials" page. ... View more