icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Dell PowerScale App for Splunk
SHA256 checksum (dell-powerscale-app-for-splunk_300.tgz) aa4c2edef4c68edec18cc2d8ee5e7a42c33216f38507879b6b6032dbdcb89698 SHA256 checksum (dell-powerscale-app-for-splunk_250.tgz) 3fcce17e2c995ffadb26d19e4a63c3e016f91d3714bf2b5173147060329143eb SHA256 checksum (dell-powerscale-app-for-splunk_240.tgz) 8fc5e368d49a9cb4dff36aed4f1c38515a2fc4c09f160d0a2da8f0de5d1397a6 SHA256 checksum (dell-powerscale-app-for-splunk_230.tgz) ff1eefab673b9bcd3c77d30be200f8fa910ad79a853da789783d8e572d198a7f SHA256 checksum (dell-powerscale-app-for-splunk_22.tgz) 4d1297e979d4d52554a8efda9533a2a1c85cdd19b437146aca9cdddd821995a9 SHA256 checksum (dell-powerscale-app-for-splunk_21.tgz) 5e5f25eb7ef5938b043d0dfccd222b09f07a958a3a3a2685b0c05b58a578fb8d SHA256 checksum (dell-powerscale-app-for-splunk_20.tgz) 61ee19fabddf5bee0d4d58c7d871fd56790df018bc085d0bcb474dabfca6e71a SHA256 checksum (dell-powerscale-app-for-splunk_10.tgz) f59c1994dde6f16cf514abe94775fc6bf60347ab171835325045b7a4f71962a0
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate


Dell PowerScale App for Splunk

Splunk Cloud
Dell EMC Isilon App for Splunk Enterprise is now Dell PowerScale App for Splunk

The Dell PowerScale App for Splunk provides the deep operational visibility that IT professionals need in order to gain insight into the health and operation of their Dell Isilon cluster.

The Dell PowerScale App for Splunk provides enhanced visibility into your cluster including detailed drill-downs, built-in correlation resulting in comprehensive analytics and faster problem resolution. This App collects data from OneFS cluster enabling you to:

- Track Cluster inventory in terms of nodes, SSDs, CPUs, Disks, storage pools, access zones etc.
- Trace Cluster performance data like disk usage, file system throughput, network throughput, CPU usage, Client connections and protocol performance.
- Track Critical events and provide ability to drill down into the events.
- Track Syslogs and Audit events of your Isilon Clusters.

Dell PowerScale App for Splunk


  • The Dell PowerScale App for Splunk builds dashboards for Data Visualization that uses the data that gets indexed in Splunk via Dell PowerScale Add-on for Splunk.
  • Author : Dell
  • Version : 3.0.0
  • Prerequisites:
    • Dell PowerScale Add-on for Splunk must be installed and inputs need to be configured to populate data on the dashboards.
  • Compatible with:
    • Splunk Enterprise versions: 9.0.x, 8.2.x, 8.1.x
    • OS: Linux, Windows
    • Browser: Google Chrome, Mozilla Firefox


Version 3.0.0

  • Added dashboard "Smart Quotas" to visualize User Quota data.

Version 2.5.0

  • Changed branding of the app.

Version 2.4.0

  • [Cluster Inventory] Node details panel in the Cluster Inventory dashboards shows wrong Up time.



  • This app has been distributed in two parts.
    1. Dell PowerScale Add-on for Splunk, which gathers data from Dell Isilon platform.
    2. Dell PowerScale App for Splunk, which uses data collected by Dell PowerScale Add-on for Splunk, runs searches on it and builds dashboard using indexed data.
  • This App can be set up in two ways:
    1. Standalone Mode:
      • Here both the apps reside on a single machine.
      • Install the Dell PowerScale App for Splunk and Dell PowerScale Add-on for Splunk on a single machine.
      • The Dell PowerScale App for Splunk uses the data collected by Dell PowerScale Add-on for Splunk and builds the dashboard on it.
    2. Distributed Environment:
      • Install App and Add-on on search head, Only Add-on on forwarder system and need to create index manually on Indexer.
      • Here also both the apps resides on search head machine, but no need to configure Add-on on search head.
      • Only Add-on needs to be installed and configured on forwarder system.
      • On Indexer, Create index from menu Settings->Indexes->New. Give the name of index (for eg. isilon), which has been used in Add-on on forwarder system.
      • Execute the following command on forwarder to forward the collected data to the indexer.
        $SPLUNK_HOME/bin/splunk add forward-server <indexer_ip_address>:9997
      • On Indexer machine, enable event listening on port 9997 (recommended by Splunk).
      • Dell PowerScale App for Splunk on search head uses the received data and builds dashboards on it.


Follow the below-listed steps to install an Add-on from the bundle:

  • Download the App package.
  • From the UI navigate to Apps->Manage Apps.
  • In the top right corner select Install app from file.
  • Select Choose File and select the App package.
  • Select Upload and follow the prompts.


  • Directly from the Find More Apps section provided in Splunk Home Dashboard.


Follow the below steps to upgrade the App.

  • Go to Apps > Manage Apps and click on the "Install app from file".
  • Click on "Choose File" and select the Dell PowerScale App for Splunk installation file.
  • Check the Upgrade app checkbox and click on Upload.
  • Restart the Splunk instance.


If dashboards are not getting populated:

  • If you are using the custom index, then make sure that isilon_index macro is updated accordingly.
  • Make sure you have the data in selected time range.
  • Make sure that the 'cluster_config' input is enabled. It can be checked by searching 'cluster_config' on 'Inputs' page of 'Dell PowerScale Add-on for Splunk'.
  • The dashboards can take some time before the data is returned which will populate some of the panels. A good test to see that you are receiving all of the data we expect is to run this search after several minutes:

    • isilon_index | stats count by sourcetype
  • In particular, you should see these sourcetypes:

    • emc:isilon:rest
    • emc:isilon:syslog
  • For "emc:isilon:syslog":

    • Check the syslog file in /etc/mcp/override/syslog.conf - it should have @<forwarders_ip_address> in front of the required log file and !* at the end of the syslog.conf file. Also run following command to see whether the syslog forwarding is enabled or not:

      1. For Dell Isilon cluster with oneFS version 8.x.x and later - isi audit settings view, isi audit settings global view
    • Dell Isilon forward syslog and audit logs on 514 udp port by default. Please make sure port 514 is open and available for Isilon syslogs.

  • If you don't see these sourcetypes, check the input log files. User can see input related logs at $SPLUNK_HOME/var/log/splunk/ta_emc_isilon_isilon.log

  • If "User" dropdown is not populating any values:

    • Verify you have configured the account in the Add-on.
    • If you are on distributed environment installation and configuration of Add-on is mandatory on Search Head.
    • If you are not seeing desired username:
      • Navigate to Settings->Searches, Reports, and Alerts. Select "TA_EMC-Isilon" in App dropdown and "nobody" in Owner dropdown, and run the "EMC-Isilon-Syslog-user-lookup-All-Time" search. Wait for few minutes until scheduled searches populates the dropdown.
      • Verify the account is configured for each hosts for which syslog data is getting collected.
  • NOTE:

    • Values under "User" dropdown is not dependent on the selection of "Cluster" dropdown.
    • Under "FS Audit Logs" dashboard, the "Most Active Users" panel is not dependent on "User" dropdown.


To disable the App, you must be logged in to Splunk as an Administrator and follow the steps below.
- Go to 'Manage Apps' from Splunk's home page.
- In the search box, type the name of the app, and then click Search. In the Status column, next to App, click Disable.


  • Uninstalling from a Standalone Environment

    • Disable the App from the Splunk user interface as detailed above.
    • Log in to the Splunk machine from the backend and delete the App folders. The app and its directory are typically located in $SPLUNK_HOME/etc/apps/<appname>.
    • Verify that no local configuration files related to Dell PowerScale App for Splunk are available in the $SPLUNK_HOME/etc/system and $SPLUNK_HOME/etc/users folders. If the local folder is present, remove it as well.
    • Restart Splunk
  • Uninstalling from a distributed or clustered environment

    • In a cluster or distributed environment, the Dell PowerScale App for Splunk is installed on all the Search Heads and the Dell PowerScale Add-on for Splunk is installed on Search Heads and Forwarders.
    • The steps to uninstall the App and Add-on are the same as for Standalone.
    • To perform any installation or uninstallation step on all the search nodes of a distributed environment, use a deployer manager.
    • From the deployer machine, go to $SPLUNK_HOME/etc/cluster/apps and remove the App and Add-on folders and execute the luster bundle command. Refer


This application contains following six saved searches, which are used in the dashboard.

  • EMC-Isilon-Cluster-Stats-lookup

    • This saved search is used to populate "ClusterStatsLookup" lookup
  • EMC-Isilon-Cluster-lookup

    • This saved search is used to populate "ClusterNameLookup" lookup
  • EMC-Isilon-Disk-lookup

    • This saved search is used to populate "NodeDiskLookup" lookup
  • EMC-Isilon-NodeMapping-lookup

    • This saved search is used to populate "NodeMappingLookup" lookup
  • EMC-Isilon-Users-Sid-lookup

    • This saved search is used to populate "UsersSidLookup" lookup
  • EMC-Isilon-Cluster-Summary

    • This saved search is used to get summary details of cluster


Copyright (C) 2023 Dell Technologies Inc. All Rights Reserved.

Release Notes

Version 3.0.0
Feb. 28, 2023
  • Added dashboard "Smart Quotas" to visualize User Quota data.
Version 2.5.0
May 15, 2020
  • Changed branding of the app.
Version 2.4.0
Oct. 1, 2018

Fixed Node Details panel in the Cluster Inventory dashboards which displayed incorrect Uptime.
Splunk 8 support

Version 2.3.0
Feb. 2, 2018
  • Added additional metrics to show IOPs by Protocol and Latency by Protocol in Protocol Details Dashboard
Version 2.2
July 18, 2017
  • Fixed JS issues of Cluster Overview dashboard to make it compatible with Splunk version 6.6
  • Fixed issue of Node details drill down in Cluster Inventory Dashboard
  • Fixed issues of user filter in FS Audit Logs, FS Audit Logs Search Facility and Authentication & Privilege Activities Dashboards
  • Added Distributed search to replicate macros in distributed environment
Version 2.1
Sept. 22, 2016
  • Added support for Active directory user & sid mapping through new REST API.
  • Made changes in Isilon log parser to make it robust & generic for both Isilon version-7 and version-8 Security logs.
  • Replaced Node_IP filter with Cluster_Name filter in existing Security logs dashboards.
  • Security logs have been segregated in two categories - FileSystem Audit Logs and Authentication & Privilege activities.
  • Added new dashboard to provide the user search facility for FS Audit logs across the Clusters.
Version 2.0
Aug. 12, 2016
Version 1.0
March 28, 2015

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.