Dell EMC Isilon App for Splunk Enterprise is now Dell PowerScale App for Splunk
The Dell PowerScale App for Splunk provides the deep operational visibility that IT professionals need in order to gain insight into the health and operation of their Dell Isilon cluster.
The Dell PowerScale App for Splunk provides enhanced visibility into your cluster including detailed drill-downs, built-in correlation resulting in comprehensive analytics and faster problem resolution. This App collects data from OneFS cluster enabling you to:
- Track Cluster inventory in terms of nodes, SSDs, CPUs, Disks, storage pools, access zones etc.
- Trace Cluster performance data like disk usage, file system throughput, network throughput, CPU usage, Client connections and protocol performance.
- Track Critical events and provide ability to drill down into the events.
- Track Syslogs and Audit events of your Isilon Clusters.
Dell PowerScale App for Splunk
- The Dell PowerScale App for Splunk builds dashboards for Data Visualization that uses the data that gets indexed in Splunk via Dell PowerScale Add-on for Splunk.
- Author : Dell
- Version : 3.0.0
- Dell PowerScale Add-on for Splunk must be installed and inputs need to be configured to populate data on the dashboards.
- Compatible with:
- Splunk Enterprise versions: 9.0.x, 8.2.x, 8.1.x
- OS: Linux, Windows
- Browser: Google Chrome, Mozilla Firefox
- Added dashboard "Smart Quotas" to visualize User Quota data.
- Changed branding of the app.
- [Cluster Inventory] Node details panel in the Cluster Inventory dashboards shows wrong Up time.
RECOMMENDED SYSTEM CONFIGURATION
TOPOLOGY AND SETTING UP SPLUNK ENVIRONMENT
- This app has been distributed in two parts.
- Dell PowerScale Add-on for Splunk, which gathers data from Dell Isilon platform.
- Dell PowerScale App for Splunk, which uses data collected by Dell PowerScale Add-on for Splunk, runs searches on it and builds dashboard using indexed data.
- This App can be set up in two ways:
- Standalone Mode:
- Here both the apps reside on a single machine.
- Install the Dell PowerScale App for Splunk and Dell PowerScale Add-on for Splunk on a single machine.
- The Dell PowerScale App for Splunk uses the data collected by Dell PowerScale Add-on for Splunk and builds the dashboard on it.
- Distributed Environment:
- Install App and Add-on on search head, Only Add-on on forwarder system and need to create index manually on Indexer.
- Here also both the apps resides on search head machine, but no need to configure Add-on on search head.
- Only Add-on needs to be installed and configured on forwarder system.
- On Indexer, Create index from menu Settings->Indexes->New. Give the name of index (for eg. isilon), which has been used in Add-on on forwarder system.
- Execute the following command on forwarder to forward the collected data to the indexer.
$SPLUNK_HOME/bin/splunk add forward-server <indexer_ip_address>:9997
- On Indexer machine, enable event listening on port 9997 (recommended by Splunk).
- Dell PowerScale App for Splunk on search head uses the received data and builds dashboards on it.
Follow the below-listed steps to install an Add-on from the bundle:
Follow the below steps to upgrade the App.
- Go to Apps > Manage Apps and click on the "Install app from file".
- Click on "Choose File" and select the Dell PowerScale App for Splunk installation file.
- Check the Upgrade app checkbox and click on Upload.
- Restart the Splunk instance.
If dashboards are not getting populated:
- If you are using the custom index, then make sure that
isilon_index macro is updated accordingly.
- Make sure you have the data in selected time range.
- Make sure that the 'cluster_config' input is enabled. It can be checked by searching 'cluster_config' on 'Inputs' page of 'Dell PowerScale Add-on for Splunk'.
The dashboards can take some time before the data is returned which will populate some of the panels. A good test to see that you are receiving all of the data we expect is to run this search after several minutes:
- isilon_index | stats count by sourcetype
In particular, you should see these sourcetypes:
Check the syslog file in /etc/mcp/override/syslog.conf - it should have @<forwarders_ip_address> in front of the required log file and !* at the end of the syslog.conf file. Also run following command to see whether the syslog forwarding is enabled or not:
- For Dell Isilon cluster with oneFS version 8.x.x and later - isi audit settings view, isi audit settings global view
Dell Isilon forward syslog and audit logs on 514 udp port by default. Please make sure port 514 is open and available for Isilon syslogs.
If you don't see these sourcetypes, check the input log files. User can see input related logs at $SPLUNK_HOME/var/log/splunk/ta_emc_isilon_isilon.log
If "User" dropdown is not populating any values:
- Verify you have configured the account in the Add-on.
- If you are on distributed environment installation and configuration of Add-on is mandatory on Search Head.
- If you are not seeing desired username:
- Navigate to
Settings->Searches, Reports, and Alerts. Select "TA_EMC-Isilon" in App dropdown and "nobody" in Owner dropdown, and run the "EMC-Isilon-Syslog-user-lookup-All-Time" search. Wait for few minutes until scheduled searches populates the dropdown.
- Verify the account is configured for each hosts for which syslog data is getting collected.
- Values under "User" dropdown is not dependent on the selection of "Cluster" dropdown.
- Under "FS Audit Logs" dashboard, the "Most Active Users" panel is not dependent on "User" dropdown.
To disable the App, you must be logged in to Splunk as an Administrator and follow the steps below.
- Go to 'Manage Apps' from Splunk's home page.
- In the search box, type the name of the app, and then click Search. In the Status column, next to App, click Disable.
This application contains following six saved searches, which are used in the dashboard.
- This saved search is used to populate "ClusterStatsLookup" lookup
- This saved search is used to populate "ClusterNameLookup" lookup
- This saved search is used to populate "NodeDiskLookup" lookup
- This saved search is used to populate "NodeMappingLookup" lookup
- This saved search is used to populate "UsersSidLookup" lookup
- This saved search is used to get summary details of cluster
Copyright (C) 2023 Dell Technologies Inc. All Rights Reserved.