Reporting

Splunk App for NetApp source VolumePerfHandler has no data

xingsd163
New Member

Hello, everyone!

I installed Splunk App for NetApp 2.0.1 on Splunk Enterprise 6.1.3. Everything is OK except that some reports related with volume have no data. I edited these panels and viewed search statements, and found these reports are related with a source: source=VolumePerfHandler. I found no this source in the ontap index.

These reports are not shown:

Proactive Monitoring -> Volume Detail -> Selected Volume Latency (ms)
Proactive Monitoring -> Volume Detail -> Data Transfer Rates (B/s)
Proactive Monitoring -> Volume Detail -> IOPS
Proactive Monitoring -> Volume Detail -> Number of Block Operations Per Second

All of them include statements like:

sourcetype=ontap:perf source=VolumePerfHandler

And, I found these is no data under index=ontap source=VolumePerfHandler.

Note: NetApp is in 7-mode.

Any advice is greaely appreciated.

Thanks in advance.

Tags (3)
0 Karma
1 Solution

bboe
Splunk Employee
Splunk Employee

It's hard to tell without looking at your environment. I would take a look at the logs splunk is generating to see what kind of errors they're generating. Here are the places that would be good to start with are any logs starting with hydra_* (from the app SA-Hydra) and with ta_ontap* - search for errors within there.

From your initial problem statement, it seems that you just aren't receiving any data for just the volumes. For this I would suggest that you download zexplore from netapp, and with that, check to see if you can get the volume perf data from the filer using their api (they should have documentation here to show you how to do that). If you can use that tool, check and see what the log messages are. There might be an issue with data collection with that particular source.,It's hard to tell without looking at your environment. I would take a look at the logs splunk is generating to see what kind of errors they're generating. Here are the places that would be good to start with are any logs starting with hydra_* (from the app SA-Hydra) and with ta_ontap* - search for errors within there.

From your initial problem statement, it seems that you just aren't receiving any data for just the volumes. For this I would suggest that you download zexplore from netapp, and with that, check to see if you can get the volume perf data from the filer using their api (they should have documentation here to show you how to do that).

View solution in original post

0 Karma

bboe
Splunk Employee
Splunk Employee

It's hard to tell without looking at your environment. I would take a look at the logs splunk is generating to see what kind of errors they're generating. Here are the places that would be good to start with are any logs starting with hydra_* (from the app SA-Hydra) and with ta_ontap* - search for errors within there.

From your initial problem statement, it seems that you just aren't receiving any data for just the volumes. For this I would suggest that you download zexplore from netapp, and with that, check to see if you can get the volume perf data from the filer using their api (they should have documentation here to show you how to do that). If you can use that tool, check and see what the log messages are. There might be an issue with data collection with that particular source.,It's hard to tell without looking at your environment. I would take a look at the logs splunk is generating to see what kind of errors they're generating. Here are the places that would be good to start with are any logs starting with hydra_* (from the app SA-Hydra) and with ta_ontap* - search for errors within there.

From your initial problem statement, it seems that you just aren't receiving any data for just the volumes. For this I would suggest that you download zexplore from netapp, and with that, check to see if you can get the volume perf data from the filer using their api (they should have documentation here to show you how to do that).

0 Karma

xingsd163
New Member

thanks very much, i will try !

0 Karma

xingsd163
New Member

Note 2: I am using the root user for NetApp to collect API data. Should I create a new user for all privileges??

0 Karma

xingsd163
New Member

Is it possible that NetApp does not have volume data generated?

0 Karma

kml_uvce
Builder

This app https://apps.splunk.com/app/1293/ only support netapp 8.x and above so could be this reason its not giving proper report.

0 Karma

xingsd163
New Member

Hi, thanks for your answer.
the NetApp version we are using is NetApp Release 8.1RC2 7-Mode. It is supported as per the docs.

0 Karma

bkondakindi
Path Finder

i have setup netapp node
few things you can cross verify.
data collector node info.
syslog enabled
index is created .
searches had proper conf settings.

0 Karma

halr9000
Motivator

Hi, please note that to get the best out of the Answers website, you'll want to use it as a Q&A site, not a forum. Only create new answers if you actually are answering the original question. Otherwise, use the "add comment" or "reply" links.

0 Karma

halr9000
Motivator

What version of DOT are you running? Note that C-mode and 7-mode are distinct from the DOT version. The minimum supported DOT version is 8.0.2 as per the docs.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...