Technical Report
NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment
Data Fabric Group/ONTAP Software and Systems Group, NetApp
December 2017 | TR-4650
Abstract
This document presents performance and reliability data for NetApp® ONTAP® in a Splunk
Enterprise environment. It also presents test results for verifying healthy Splunk responses
to restoring deleted data from snapshots and for recovering from a controller and disk
drive failure.
2 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
TABLE OF CONTENTS
1 Introduction.................................................................................................................................4
2 Solution Overview .......................................................................................................................5
2.1 Target Audience .....................................................................................................................................................5
2.2 Solution Architecture ..............................................................................................................................................5
2.3 Solution Positioning ...............................................................................................................................................6
3 Test Plan Summary .....................................................................................................................7
4 Test Results Summary ................................................................................................................7
5 Technology Overview..................................................................................................................9
5.1 Splunk .....................................................................................................................................................................9
5.2 NetApp AFF Systems Powered by ONTAP 9 ....................................................................................................10
6 Test Configuration Details......................................................................................................... 12
6.1 Infrastructure ........................................................................................................................................................12
6.2 Indexer Storage Configuration ............................................................................................................................13
7 Test Procedure and Detailed Results ........................................................................................ 14
7.1 Performance Baseline Test: Indexing Rate ........................................................................................................14
7.2 Performance Baseline Test: Query Execution Performance .............................................................................15
7.3 ONTAP Storage Efficiency Test ..........................................................................................................................18
7.4 Backup and Restore Test ....................................................................................................................................19
7.5 Storage System Resilience Test (Controller Failure) .........................................................................................22
7.6 Disk Failure and Reconstruct Test ......................................................................................................................24
7.7 Splunk Indexer Failure Test.................................................................................................................................27
7.8 Creation of Data Copies with FlexClone Technology Test ................................................................................28
8 Conclusion ................................................................................................................................ 31
Appendix A: Storage Configuration ................................................................................................ 32
Output for df -S Command ...........................................................................................................................................32
Output for df -A -S Command.......................................................................................................................................33
Output for lun show Command.....................................................................................................................................33
Output for sysconfig -r Command on Storage Node 01..............................................................................................34
Output for sysconfig -r Command for Storage Node 02 .............................................................................................37
Output for sysconfig -a Command for Storage Node 01.............................................................................................39
Output for sysconfig -a Command for Storage Node 02.............................................................................................45
Output for vol show Command.....................................................................................................................................50
3 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
Appendix B: Test Configuration Details .......................................................................................... 51
Servers Used with AFF A700 FC SAN Configuration .................................................................................................51
Servers Used with Internal DAS Configuration ...........................................................................................................51
Acknowledgements......................................................................................................................... 52
Where to Find Additional Information ............................................................................................. 52
Version History ............................................................................................................................... 53
LIST OF TABLES
Table 1) ONTAP FC SAN test results summary. .................................................................................................................7
Table 2) Splunk indexing rate performance comparison. ....................................................................................................8
Table 3) Splunk search performance for AFF A700 versus DAS. .......................................................................................8
Table 4) LUN provisioning details. ......................................................................................................................................13
Table 5) Splunk indexing rate performance comparison. ..................................................................................................14
Table 6) Splunk search performance: AFF A700 versus DAS. .........................................................................................15
LIST OF FIGURES
Figure 1) Tested configuration...............................................................................................................................................6
Figure 2) Network topology of tested configuration............................................................................................................12
Figure 3) Indexing rate comparison: A700 versus DAS. ....................................................................................................15
Figure 4) Dense search completion time comparison........................................................................................................16
Figure 5) Very dense search completion time comparison................................................................................................17
Figure 6) Sparse search completion time comparison.......................................................................................................17
Figure 7) Very sparse search completion time comparison...............................................................................................18
Figure 8) Savings from storage efficiency as shown in OnCommand System Manager. ................................................18
Figure 9) DAS configuration. ...............................................................................................................................................52
4 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
1 Introduction
It’s been estimated that data will grow exponentially well beyond the year 2020. Some studies predict
that by the year 2025, the amount of data in existence will have grown by a factor of 10 times the amount
in 2017. This data comes in many forms, ranging from semistructured to totally unstructured. Sources
include the Internet of Things (IoT), business applications, social media, customer behavior, and machine
sensors, to name just a few.
In this age of digital transformation, machine data is one of the key drivers fueling that growth. Machine
data is generated by technology infrastructures, security systems, and business applications. It's one of
the fastest growing types of data, and it’s also one of the most complex categories of big data. With that
complexity comes high value in the form of information about customer behavior, business and personal
transactions, sensor readings, machine behavior, security threats, and fraudulent activity. Splunk
Enterprise software provides the ability to extract the value from any machine data in real time.
Enterprise organizations depend on big data to help run their businesses, to meet competitive demands
in the market place, and to avoid costly infrastructure downtime. The ability to collect and analyze this
data is key to transportation safety, machine reliability, fraud detection, and security. Enterprise data
protection is an absolute necessity in meeting these demands, which include the following:
• 100% uptime and data availability
• Robust data protection to meet low recovery point objectives (RPOs) and recovery time objectives (RTO)s, with zero loss of data
• Full support for disaster recovery (DR)
• Cost-effective support for DevOps
• Data security
• SEC-compliant backups
• High performance
• Seamless integration with public and private cloud for scale and agility
• Full scalability of data storage
• Storage efficiency to meet cost objectives
This technical report demonstrates that NetApp ONTAP integration with Splunk exceeds these enterprise
requirements for machine data collection and analysis. This document contains the following information:
• The architectural details of a tested Splunk solution integrated with a NetApp All Flash FAS (AFF) storage array
• A test plan for validating the solution and demonstrating NetApp ONTAP enterprise-class data
management and data protection features with Splunk
• Proof points and results from execution of the test plan
• Performance comparison between the AFF configuration and a typical Splunk configuration using commodity servers and internal storage media
NetApp contracted with Global Technology Resources, Inc. (GTRI), in partnership with NetApp Technical Marketing Engineering, to configure the Splunk test environment and execute the test plan. GTRI provides proven IT solutions that address business challenges to drive revenue, reduce costs, and reduce risks for enterprise organizations that are undergoing digital transformation. They also provide professional services, enterprise consulting, and training services, with Splunk being one of their core competencies.
For more information about GTRI, see the GTRI website.
5 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
2 Solution Overview
Traditionally, Splunk was configured to use commodity servers with internal storage media (disk drives
and solid-state drives [SSDs]). This storage configuration is often referred to as direct-attached storage
(DAS). Splunk best practices recommend configuring those internal disks by using RAID 10, also known
as RAID 1+0. In a RAID 10 configuration, data is striped across pairs of mirrored disk drives to improve
input/output (I/O) performance and to protect against data loss in the event of disk failure. Because of
RAID 10 mirroring, only half of the total raw disk capacity is available. Also, once all the disk drive bays in
the servers are full, more servers must be added to accommodate data growth. This type of configuration
leads to poor storage efficiency and a perpetual imbalance between compute and storage, because
compute and storage cannot be scaled independently.
By storing Splunk data on NetApp AFF powered by ONTAP 9 instead of on internal storage media,
compute and data storage resources are decoupled, allowing enterprises to create efficient configurations
that meet their needs today as well as tomorrow. Servers need to be added only when additional compute
resources are required, and storage can be scaled out independently of compute. Valuable rack space,
floor space, and energy are conserved.
In addition to independent scaling of resources, ONTAP provides the data protection, data governance,
storage efficiency, and copy management features needed to meet the requirements of enterprise
organizations that use Splunk. Those features are discussed later in section 5.2.
2.1 Target Audience
The intended audience of this document includes sales engineers, field consultants, professional
services, IT managers, partner engineering, and customers who want to take advantage of an
infrastructure built to deliver high-performance and enterprise-class features for Splunk deployments. It is
assumed that the reader has a basic understanding of Splunk, NetApp storage, the Linux operating
system, and basic network topologies.
2.2 Solution Architecture
The Splunk solution discussed in this document was built by using the following components, as
illustrated in Figure 1:
• Splunk version 6.6.3:
8 indexer servers
3 universal forwarders
1 cluster master
1 search head
Splunk search factor: 2
Splunk replication factor: 3
• Red Hat Enterprise Linux Server release 7.2: all servers
• NetApp AFF A700 Storage Array (high-availability [HA] pair):
ONTAP 9.2
24 x 960GB SSDs
1 x 550GB FC LUN per indexer
FC protocol
4 dual-port 32Gbps FC adapters
• 13 Fujitsu Primergy RX2540 M1 servers each equipped with:
2 CPUs, 16 physical cores total
6 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
Intel Xeon CPU E5-2670 v3 @ 2.30GHz
256GB physical memory
2 x 300GB SAS OS drives (mirrored)
16Gbps FC, dual controller
10GbE dual port
Figure 1) Tested configuration.
Details of the DAS configuration used for comparison in this document are provided in Appendix B, with a
graphical representation in Figure 9.
2.3 Solution Positioning
The solution described in this document is not the only NetApp solution for Splunk. There is also a
solution based on the NetApp E5700 storage array, which is documented in TR-4623: NetApp E-Series
E5700 and Splunk Enterprise. The E-Series solution provides excellent performance and flexibility at a
very competitive cost. The AFF A700 solution described here was designed for environments where
enterprise-class data management features are required. Those features include fast backup and restore
capabilities with storage-efficient ONTAP Snapshot™ technology, storage efficiency with deduplication
and compression, Data Fabric enablement, and DevOps support with NetApp FlexClone® volumes.
Implementation of these features with Splunk is discussed later in this document.
7 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
3 Test Plan Summary
A test plan was executed to provide proof points that a NetApp AFF storage system powered by ONTAP
9 is the ideal data protection/data management platform for enterprise-class organizations using Splunk
to capture and analyze machine data. Not all of the enterprise requirements listed in section 1 were
demonstrated in this study. Items that have been omitted are considered more generic to enterprise-class
storage and are discussed in section 5.2.
All tests were executed with Splunk workflows running. Splunk’s Eventgen utility was used for that
purpose. The validation test plan included the following steps:
1. Perform baseline by using Eventgen to load and index 1TB of sample log data.
2. Perform dense and sparse searches and capture the time requirements of each.
3. Capture ONTAP storage efficiency results from NetApp OnCommand® System Manager.
4. Perform backup and restore operations using NetApp Snapshot and SnapRestore® technologies.
5. Perform storage resilience tests:
a. Failure of a storage node by generating a system panic:
Takeover
Giveback
b. Disk failure and reconstruct
6. Capture Splunk indexer failure: four indexers failed, one after the other.
7. Create a cloned Splunk environment by using NetApp FlexClone technology.
4 Test Results Summary
Each test case completed successfully and fully supported ONTAP as the enterprise-class data
management and protection platform for Splunk. Table 1 shows the results.
Table 1) ONTAP FC SAN test results summary.
Test Description Results Summary
Baseline performance Performance exceeded that of a comparable Splunk DAS configuration for 7
out of 10 tests. Same performance for remaining tests.
Storage efficiency Efficiency ratio: 2.04:1 from inline deduplication and compression.
Snapshot copy creation No visible impact on performance.
SnapRestore Successful. After the data restore operation, Splunk search result was the
same as before data loss.
Storage controller panic No observed impact on Splunk performance; search completed successfully.
Disk failure and reconstruct No observed impact on Splunk performance; search completed successfully.
Splunk indexer failure Minimal impact on Splunk performance; minor spikes during failure event.
FlexClone volume creation No observed impact on Splunk performance; clone configuration for Splunk
completed.
Table 2 contains performance results from the average and peak indexing rates observed during the
benchmark phase of the tests. In this test, the metric is megabytes per second (MBps); therefore, higher
numbers are preferable. As the numbers indicate, the average Splunk indexing rate for the AFF A700
configuration was more than twice that of the DAS configuration, with a performance improvement of
8 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
109% over DAS. As expected, the peak indexing rate of the A700 configuration was considerably higher
than the average rate, meaning that there was variation in the indexing rate during the indexing
performance test, which is not unusual.
Note: Peak indexing performance data for the commodity server DAS configuration was not available.
Table 2) Splunk indexing rate performance comparison.
Data
Ingest Volume
Average Indexing Rate Observed Peak Indexing Rate Observed
AFF A700 Commodity
Servers with DAS
% Faster
A700 Compared to DAS
AFF A700 Commodity
Servers with DAS
% Faster
A700 Compared to DAS
~1000
GB/day 31.114MBps 14.872MBps +109% 43.892MBps N/A N/A
In addition to the indexing rate, search performance tests were also performed. Splunk Eventgen was
used to generate four different types of searches and capture the completion time of each. Table 3 shows
those results, along with corresponding results from the DAS configuration. The metric of interest in this
set of tests is search completion time in seconds (described in detail later in this section); therefore, lower
numbers indicate better performance.
• A dense search scans through machine-generated data and reports on many events. Examples
include searches that return the number of errors on a web server, or all failed login events on a database server. A dense search results in 1 match per 1,000 lines of log data, while a very dense search results in 1 match per 100 lines.
• A sparse search scans through data looking for a single event or an event that occurs infrequently.
This search is referred to as a “needle in a haystack” search. A sparse search returns 1 match out of 1,000,000 lines scanned, while a very sparse search returns 1 match per 10,000,000 lines.
In this test plan, both searches were tested, while data was being indexed (streamed) and while data was
not being indexed (static). Table 3 lists the search results from the AFF A700 environment compared to
the commodity server with DAS configuration. The reported number is number of seconds for each
search to complete. In this test, a lower number is better. The results clearly show that the A700
outperformed DAS by a wide margin for five of the eight searches tested, and provided equivalent
performance to DAS for the remaining tests.
Note: The numbers in the % Faster columns show how much faster the queries ran on the A700 than with the DAS configuration. For example, comparing the A700 completion time for the dense search with streaming to the DAS configuration, the following formula was used:
(19.79 – 8.128) / 8.128 = 1.4348
The query ran 143% faster with the A700 than with DAS.
Table 3) Splunk search performance for AFF A700 versus DAS.
Forwarder to
Indexer Search Performed
Streaming Search Time (Seconds) Static Search Time (Seconds)
AFF A700 Commodity
Servers
with DAS
% Faster A700
Compared to
DAS
AFF A700 Commodity
Servers
with DAS
% Faster A700
Compared to
DAS
Dense 8.128 19.79 143% 8.136 32.7 302%
Very dense 24.147 43.35 80% 20.226 49.15 143%
Sparse 2.065 2.07 0% 2.061 5.02 144%
Very sparse 2.065 2.07 0% 2.061 2.07 0%
Note: Details of the tests and the test results are described in section 7.
9 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
5 Technology Overview
5.1 Splunk
Machine data is the fastest-growing type of big data. The format is unpredictable, coming from so many
different sources, at such a high rate, and in such great volumes, that it’s often referred to as digital
exhaust. It’s constantly being generated by servers, server infrastructures, applications, sensors,
electronics, buildings, security systems, and all the elements that make up the IoT. Machine data is
tremendously valuable, in that it contains records of customer behavior, transactions, diagnostics from
critical mechanical systems, message queues, change events — and the list goes on. It's difficult to
unlock the value in this data due to its high volume and lack of structure. Splunk Enterprise provides the
platform for collecting, indexing, and analyzing machine data from any source to deliver operational
intelligence, which can be used to optimize IT, security, and business performance. It provides powerful
search, analysis, and visualization capabilities that can be accessed across organizations, and is
available as on-premises software or as a cloud service.
Splunk uses a distributed search framework that scales linearly. Its implementation of MapReduce
enables large-scale search, reporting, and alerting. The Splunk platform is open and has software
development kits (SDKs) and application programming interfaces (APIs), including a REST API and SDKs
for Python, Java, JavaScript, PHP, Ruby, and C#. It also provides node failover and workload balancing
across components.
Splunk Use Cases
Common use cases for Splunk include:
• Analyze system performance: log monitoring and reporting with trend analysis
• Troubleshoot failure condition: root cause analysis using system logs
• Monitor business metrics: analysis of output from business applications and real-time data
• Search and investigate an outcome
• Create dashboards to visualize and analyze results
• Provide security monitoring and assurance
At a time when large-scale data breaches and cyberthreats often make headlines, security is a primary
concern for everyone, from the largest online retailers to anyone who has a bank account. Splunk offers a
very powerful framework for fraud prevention and security. Use cases include:
• Malware detection and investigation:
Detect infected hosts
Determine the spread of malware
• Data exfiltration—unauthorized transfer of data over a network:
Monitor transactions
Isolate suspicious events
• Privileged user monitoring:
Prevent or contain advanced attacks
Prevent or contain insider threat-based attacks
• Identification of patient zero malware:
Identify command-and-control network communications
Identify malware-infected hosts
Identify first infected host (patient zero) of a malware outbreak
• Detect zero-day attacks—exploitation of unknown software security vulnerability:
10 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
Splunk Enterprise Security Risk Analysis Framework
Security Domain dashboards
• Fraud detection—account takeovers:
Detect and investigate
Remediation actions initiated by Splunk
• Ensure compliance—detect when critical systems stop sending logs to Splunk:
Avoid regulatory compliance issues
Investigation and remediation actions
• User Behavior Analytics (UBA) for insider threats:
Detect and mitigate insider threats
Fully automated and continuous monitoring
• UBA for external threats:
Detect cyberattacks of malware and hidden threats
Stop external threats before it’s too late
Of all the Splunk use cases, security is the most critical for any organization or individual. It’s so critical
that Splunk offers a product that is completely dedicated to security. For Splunk to provide the high level
of security required today, the product must be configured for continuous uptime and optimal
performance. NetApp AFF storage arrays powered by ONTAP provide the features and tools to meet
those requirements.
5.2 NetApp AFF Systems Powered by ONTAP 9
NetApp is the data authority for hybrid cloud, data protection, data availability , and copy management.
NetApp empowers customers to simplify and integrate data management across cloud and on-premises
environments to accelerate digital transformation. Together with its partners, NetApp offers a full range of
hybrid cloud data services to help global organizations unleash the full potential of their data to expand
customer touchpoints, foster greater innovation, and optimize their operations. This section summarizes
key NetApp technologies and features.
NetApp All Flash FAS Storage Arrays
NetApp AFF systems address enterprise storage requirements with high performance, flexibility, and
best-in-class data management. Built on ONTAP software and designed specifically for flash, AFF
systems deliver industry-leading performance, capacity density, scalability, security, and network
connectivity. NetApp AFF storage provides both 40 Gigabit Ethernet (40GbE) and 32Gbps FC
connectivity. AFF systems are Data Fabric ready, with proven cloud connectivity, enabling you to move
workloads where they run best and data where it’s needed.
With NetApp RAID DP® technology, AFF systems provide industry-leading, in-place data protection. Also,
with the NetApp flash-optimized WAFL® system and enhanced built-in quality of service (QoS), consistent
high performance at 1ms latencies and lower is achieved.
AFF systems are scalable and highly available. For more information about the enterprise-grade data
management features of AFF systems, see the NetApp All Flash FAS Datasheet.
The following sections describe some of the key AFF ONTAP features.
NetApp ONTAP Snapshot and SnapRestore Technologies
With ONTAP Snapshot technology, you can create point-in-time data copies with no impact on
performance and with minimal consumption of storage space. You can create these Snapshot copies
11 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
almost instantaneously and use them with the SnapRestore software to recover entire file systems or data
volumes in seconds.
NetApp FlexClone Volumes
FlexClone volumes are space-efficient, writable data copies that can be created almost instantly,
anywhere in the Data Fabric or hybrid cloud where a Snapshot copy exists. FCP, iSCSI, and NFS are
supported protocols, and they are perfect for DevOps. FlexClone technology makes it possible for
developers, QA engineers, and software testers to work with real production data. FlexClone volumes can
be easily created and deleted, and any changes made to them have zero impact on the parent production
data. They can even be split from the parent production data and promoted to production, if necessary.
FlexClone volumes can be considered as free data copies.
NetApp Storage Efficiency
ONTAP 9 offers inline deduplication, compression, and compaction. Whether written to on-premises or
cloud storage, the data occupies less space, which translates to lower data storage costs.
NetApp SnapMirror
NetApp SnapMirror® works with ONTAP Snapshot copies to transport data seamlessly and efficiently
between NetApp storage systems to support backup, restore, and DR operations. SnapMirror simplifies
data protection management across the Data Fabric with cross-platform replication from flash to disk to
cloud. It provides data replication between ONTAP devices, regardless of the host protocol or ONTAP
version. Supported platforms include NetApp AltaVault™, ONTAP, and ONTAP Cloud. SnapMirror is both
policy-driven and network optimized. Only changed blocks are sent across the network, and network
compression is built in.
NetApp Data Fabric
The technologies described so far in this section are just a few of the components of the NetApp Data
Fabric, which represents NetApp's vision for the future of data management. The Data Fabric architecture
allows users to move workloads freely and easily where they run best and to move data where it’s
needed. It supports on-premises data storage and management as well as storage and management in
the cloud, hybrid cloud, and private cloud ecosystems. With the NetApp Data Fabric, data becomes more
mobile, scalable, and accessible. Users are no longer limited to a single public cloud provider, because
data can now be moved between clouds. Also, data can be managed across multiple environments by
using common tools and processes, regardless of its location.
Splunk App for NetApp Data ONTAP
The Splunk App for NetApp Data ONTAP enables you to visualize the configuration, performance, and
syslog events for all NetApp Data ONTAP® storage arrays in your Splunk deployment. With the Splunk
App for Data ONTAP, you can do the following from a single pane of glass:
• Reduce problem investigation and resolution times.
• Gain real-time insights into key performance metrics, anomalies, and outliers across all your storage
systems and configured subsystems.
• Improve your storage monitoring efficiency and proactively plan storage capacity allocations with more than 30 out-of-the-box, customizable reports.
• Correlate data from all NetApp systems with data from operating systems, applications, networks, and virtual and physical infrastructure for enterprise-wide 360-degree visibility.
• Get central proactive monitoring of Data ONTAP systems, including real-time notification of important Data ONTAP events.
12 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
For more information, see Splunk App for NetApp Data ONTAP.
6 Test Configuration Details
This section describes our tested configuration: the network infrastructure, Splunk server functionality,
storage provisioning details, and Linux host-side storage configuration.
6.1 Infrastructure
The test results were created with eight Splunk Indexer servers connected to a NetApp AFF A700 storage
array over 16Gb FC. The indexer servers were connected to a Splunk 10GbE network of three
forwarders, controller monitor, and search head RHEL 7.2 servers.
Figure 2) Network topology of tested configuration.
The components in Figure 2 provide the following functions:
• The indexer servers receive and index incoming data, send or receive replicated data in the cluster, and search across indexed data for search requests from the search head.
• The forwarders consume data from external sources and forward it to indexer servers.
• The search head manages searches across the cluster of indexer servers. It distributes the search
queries to the indexer servers and consolidates the results.
Note: All searches are run from the search head. Each cluster must have at least one search head.
13 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
• The cluster master (controller monitor) manages the Splunk cluster. It coordinates replicating activities of the indexer servers and communicates with the search head for information about where to locate data for searches. It also remediates activities if an indexer server goes offline.
Note: Each cluster has only one controller monitor.
• The machine log data from the Splunk forwarders sent to the indexer peer nodes uses the recommended data replication factor of three, which makes available three copies of data. The ingested data is compressed and indexed as raw data files and metadata, which are then distributed
among the indexer peer nodes for redundancy.
6.2 Indexer Storage Configuration
One FC LUN was assigned to each indexer. LUNs were configured with one LUN per storage volume,
with four volumes in aggregate aggr1 and the other four volumes in aggregate aggr2. Aggr1 was
configured on the first storage controller and aggr2 was configured on the second controller. LUNs were
550GB is size, with the corresponding volumes being 600GB in size. Table 4 lists the provisioning details
for the LUN used by the indexers.
Table 4) LUN provisioning details.
Controller Aggregate Volume LUN Aggregate
Size Volume Size LUN Size
Controller 1
Aggr1 6.91TB
Vol1 LUN1 600GB 550GB
Vol2 LUN2 600GB 550GB
Vol3 LUN3 600GB 550GB
Vol4 LUN4 600GB 550GB
Controller 2
Aggr2 6.91TB
Vol5 LUN5 600GB 550GB
Vol6 LUN6 600GB 550GB
Vol7 LUN7 600GB 550GB
Vol8 LUN8 600GB 550GB
Both aggregates (aggr1 and aggr2) were created with an SSD count of 23.
After storage was provisioned and mapped to the indexers, the following tasks were completed as part of
the test:
1. Created a single logical volume group on each LUN, one volume group per indexer.
2. Created one logical volume on each volume group.
3. Created an XFS file system on each logical volume.
4. Created a mount point for the XFS file system named /splunk on each indexer.
5. Mounted the new file system under the /splunk mount point by using the following options:
Allocsize = 128m
14 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
noatime
nobarrier
nodiratime
7 Test Procedure and Detailed Results
The AFF A700 Splunk configuration test plan included the following test cases:
1. Performance baseline test: average and peak indexing rate
2. Performance baseline test: query execution time
3. ONTAP storage efficiency test (for 1TB of indexed data)
4. Snapshot copy creation; impact on performance
5. Backup and restore test (using SnapRestore technology); ability to successfully restore data from a
Snapshot copy following catastrophic data loss
6. Storage system resilience test; impact of storage controller panic on running Splunk query
7. Disk failure and reconstruct test; impact on running query
8. Splunk indexer failure test
9. Creation of data copies with FlexClone technology test:
a. Impact on running query
b. Ability to configure indexers to use clones
Note: The following sections describe each test case in detail.
7.1 Performance Baseline Test: Indexing Rate
For this test, the Splunk Eventgen utility was used to generate approximately 1TB of simulated syslog
data. That data was spread evenly across the three forwarders and then streamed to the eight indexers,
where it was indexed and stored on the AFF A700. Both peak and average indexing rates were captured
by using the Splunk Search and Reporting App. Those results are recorded in Table 5 and Figure 3,
along with test results from a similar Splunk configuration using DAS. Notice that for the average indexing
rate, the AFF A700 configuration outperformed the commodity servers with DAS by 109%. In other words,
indexing was more than twice as fast as with DAS. Peak indexing rate for the DAS configuration was not
available.
Table 5) Splunk indexing rate performance comparison.
Data Ingest
Volume Average Indexing Rate Observed Peak Indexing Rate Observed
AFF A700 Commodity
Servers with DAS
% Faster
A700 Compared to DAS
AFF A700 Commodity
Servers with DAS
% Faster
A700 Compared to DAS
~1000GB/day 31.114
MBps
14.872MBps +109% 43.892
MBps
Not Available N/A
Figure 3 is a graphical view of the data in Table 5, emphasizing the indexing performance difference
between the A700 and DAS configurations. As with all of the tests, the Splunk Eventgen utility was used
to generate the workflow I/O.
15 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
Figure 3) Indexing rate comparison: A700 versus DAS.
7.2 Performance Baseline Test: Query Execution Performance
After the indexing rate test was complete, the query execution tests were performed. The following query
types were run using Eventgen:
• Dense search. A query that scans data and reports multiple events. A dense search returns 1 match per 1,000 lines of log data scanned.
• Very dense search. A very dense search returns 1 match per 100 lines.
• Sparse search. A query that scans through data looking for a single event or an event that occurs
infrequently. A sparse search returns 1 match out of 1,000,000 lines scanned.
• Very sparse search. A very sparse search returns 1 match per 10,000,000 lines scanned.
Note: Examples of a dense search include searches that return the number of errors on a web server, or all failed login events on a database server.
Note: Sparse searches are often referred to as “needle in a haystack” searches.
Each type of search was performed with indexers actively indexing data and with indexers in a static
state. Those results are presented in Table 6, along with results from the same tests performed with a
similarly configured DAS Splunk environment. The key metric of these tests is completion time in
seconds; therefore, lower numbers are better.
Table 6) Splunk search performance: AFF A700 versus DAS.
Forwarder to
Indexer Search Performed
Streaming Search Time (Seconds) Static Search Time (Seconds)
AFF A700 Commodity
Servers with DAS
% Faster A700
Compared to DAS
AFF A700 Commodity
Servers with DAS
% Faster A700
Compared to DAS
Dense 8.128 19.79 143% 8.136 32.7 302%
Very dense 24.147 43.35 80% 20.226 49.15 143%
Sparse 2.065 2.07 0% 2.061 5.02 144%
Very sparse 2.065 2.07 0% 2.061 2.07 0%
16 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
The results clearly show that the A700 outperformed DAS by a wide margin for five out of eight queries
performed. Performance was about the same as DAS for the remaining tests. The numbers in the %
Faster columns show how much faster the queries ran on the A700 than with the DAS configuration. For
example, comparing the A700 completion time for the dense search with streaming to the DAS
configuration, the following formula was used:
(19.79 – 8.128) / 8.128 = 143%
The query ran 143% faster with the A700 than with DAS.
For the AFF A700 configuration, on average, dense and very dense searches (streaming and static) ran
143% and 302% faster, respectively, then with the DAS configuration:
• Dense searches with concurrent streaming ran 143% faster than with DAS.
• Dense searches without concurrent streaming (static) ran 302% faster than with DAS.
• Very dense searches with concurrent streaming ran 80% faster than with DAS.
• Very dense searches without concurrent streaming (static) ran 143% faster than with DAS.
• For sparse and very sparse searches, the A700 either outperformed DAS or performed at par with DAS:
Sparse and very sparse searches, with and without concurrent streaming, performed about the same as with DAS, as did very sparse searches without concurrent streaming.
Sparse searches without concurrent streaming ran 144% faster than with DAS.
Figures 4 through 7 are graphical representations of these results.
Figure 4) Dense search completion time comparison.
17 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
Figure 5) Very dense search completion time comparison.
Figure 6) Sparse search completion time comparison.
18 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
Figure 7) Very sparse search completion time comparison.
7.3 ONTAP Storage Efficiency Test
After the performance benchmark tests, storage efficiency was queried by using OnCommand System
Manager, as shown in Figure 8. Overall storage efficiency for the aggregates used in our Splunk
configuration was reported to be 2.04:1 for about 2TB of actual data. The storage savings is the result of
inline deduplication and compression.
Figure 8) Savings from storage efficiency as shown in OnCommand System Manager.
The size of the dataset was approximately 1.91TB, but the actual physical space used was only about
959.29GB. The space savings is the result of ONTAP inline deduplication and compression. Results can
vary based on actual data, but in this case, the physical size of our data was approximately half the size
of the actual data. A closer look revealed that approximately 25% of the reduction was the result of
deduplication and the remaining was the result of compression.
19 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
Best practices for Splunk using DAS require storage media to be configured as RAID 10, which involves
mirroring. In that configuration, Splunk has access to only half of a server’s internal storage. With NetApp
AFF storage, Splunk data requires storage space equal to half the size of the actual data. In other words:
1TB of DAS can store .5TB of data, while 1TB of AFF storage can store 2TB of data!
7.4 Backup and Restore Test
The following procedure was performed for the backup and restore test:
1. OnCommand System Manager was used to create Snapshot copy backups of all eight data volumes. Those Snapshot copies were created while a query was being run. Performance was monitored and there was no visible impact.
2. The Splunk data was queried to establish a healthy baseline.
20 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
3. All Splunk data was deleted to simulate total data loss.
The query failed with an error.
4. To start the restore operation, the following steps were completed:
a. All Splunk processes were stopped.
b. All data file systems on the indexers were unmounted.
c. All eight data volumes used by the indexers were restored from previously created Snapshot
copies by using SnapRestore, as shown in the following screenshots.
21 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
22 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
5. The restored file systems were then mounted on the indexers and Splunk was restarted. The same query was executed again and produced identical results as before all data was destroyed. The SnapRestore operation completed in a matter of seconds. The data was restored and fully available in less than 5 minutes following a catastrophic data loss.
7.5 Storage System Resilience Test (Controller Failure)
The following procedure was performed for the storage system resilience test:
1. A Splunk workflow was applied to a healthy system and then a controller failure was induced to observe the response from Splunk.
2. While a workflow was running, a panic was induced on one of the storage controllers.
23 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
3. From OnCommand System Manager, the impact on the storage system was observed.
At this point, the surviving controller took over for the failed controller and served data from the failed controller's disks.
4. Several minutes later, the affected controller was recovered, a giveback was performed, and it was
observed that both controllers were up and healthy.
24 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
5. Splunk performance was monitored throughout the test.
The panic was induced 1 minute after the workflow was started. Performance was monitored for 1
minute after giveback was completed. There was no visible impact on Splunk performance during that time, and the workflow completed successfully. Results may vary regarding the performance impact, depending on controller resource utilization.
7.6 Disk Failure and Reconstruct Test
The following procedure was performed for the disk failure and reconstruct test:
1. A disk drive was failed during a Splunk index operation. In this example, disk 1.0.15 in System Manager was chosen for the test.
25 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
2. Disk 1.0.15 was failed in immediate mode, without allowing any time for the contents to be copied to a replacement disk.
3. The status of disk 1.0.15 was broken.
26 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
4. After 2 minutes, the disk was manually unfailed.
5. The previously failed disk was recovered as a spare. Reconstruction had already begun on another spare disk.
27 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
6. Reconstruction completed in approximately 20 minutes as the Splunk workflow continued to run without any noticeable impact.
There was no visible impact on performance as the Splunk workflow completed.
7.7 Splunk Indexer Failure Test
The following procedure was performed for the Splunk indexer failure test:
1. Four out of eight indexers were manually failed, one by one, using the Linux kill command to end
the Splunk processes, while an indexing workflow was in progress. There was zero impact on performance, and the workflow was not interrupted as the indexers failed.
The purpose of this test was not to capture the impact of indexer failure on performance, but to demonstrate that NetApp storage fully supports indexer node failover. The impact on performance
would be determined by CPU and memory utilization on the servers, but not by storage I/O bandwidth utilization. Since storage in this configuration is shared at the controller and aggregate levels, and connectivity between the servers and storage is achieved by using 16Gbps FC, failure of an indexer would have no impact on storage performance. Storage I/O bandwidth utilization remained the same,
28 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
as did Splunk query performance. Use of NetApp AFF storage fully supports Splunk's indexer failover capability.
7.8 Creation of Data Copies with FlexClone Technology Test
The purpose of the creation of data copies was to demonstrate the use of NetApp FlexClone technology
to create free, instant copies of production data. The following procedure was performed for this test:
1. FlexClone volumes of the data volumes used by four of the indexers were created, as shown in the following screenshot.
2. The LUNs in the FlexClone volumes were mapped to four unused servers.
3. Cloned file systems were mounted to the unused servers.
4. A list of the newly created FlexClone volumes is displayed.
29 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
The actual physical footprint of the clones ranges from 8.09MB to 48.63MB, while the storage capacity of each clone is 600GB. Relatively speaking, these FlexClone volumes really are free data copies.
A list of the new LUNs along with the volume clones containing them is displayed.
5. After the new LUNs are brought online, they are mapped to initiator groups.
30 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
Note: Each volume clone contains a single LUN, and each LUN contains a copy of the logical volume and file system from the parent volume.
6. The following procedure was executed on each new indexer server to mount the file systems that exist on the cloned LUNs:
a. Ran the rescan-scsi-bus.sh -a command to make the cloned LUNs visible to the indexer
server.
b. Ran the vgscan command to discover the volume group on the LUN clone.
c. Ran the lvscan command to discover the logical volume on the LUN clone volume group.
d. Created a new mount point for the new file system; for example, executed the mkdir /splunk
command.
e. Added the new file system to the Linux /etc/fstab file on the new indexer server and then
mount the cloned file system by running the mount /splunk command.
7. Ran the Linux find command to confirm that the data existed in the cloned file system.
31 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
8. The Splunk cluster was configured to use the four new indexer servers. Splunk processes were started, and the cluster was ready for workflow execution.
8 Conclusion
Machine data is one of the fastest growing types of big data. That data, often referred to as digital
exhaust, is generated in real time with sources including IT infrastructures, web servers, online retail and
financial systems, machine sensors, and all the elements that make up the IoT. Machine data is
unstructured, has very high velocity, and is extremely large in volume, making it impossible to capture
and analyze using traditional analytics tools, such as traditional relational databases. Depending on the
source, machine data might contain computer logs, location data, sensor readings, output from medical
devices, records of financial transactions, and records of security-related events, to name just a few.
Splunk provides the tools and capabilities that allow an enterprise organization to collect that data and
extract high value from it, such as patterns of customer behavior, trending data that might predict
equipment failure, and indications of financial fraud. Those tools and capabilities include visualization,
extremely fast data ingest, real-time analytics, a rich set of APIs, notification capabilities, and extreme
scalability.
Enterprise organizations depend on the continuous availability and continuous analysis of data. In the
area of healthcare, where critical medical devices are monitored in real time, seconds can mean the
difference between life and death. In the area of security, real-time analytics can help prevent financial
fraud and attacks on sensitive computer systems. If a security breach has already occurred, or in case of
a cyberattack, analytics can help identify the source and limit the damage. For an enterprise guarding
against security breaches and intrusions, microseconds matter. Traditional Splunk deployments with
direct-attached storage are subject to server sprawl. The Splunk best practice recommendation to
configure server storage with mirroring means that only half of a server’s storage capacity is available for
data. Also, adding storage capacity requires servers to be added, even if additional compute capacity is
not needed. Splunk also relies on traditional methods for data protection and DR, which are slow and
consume valuable storage and compute resources. Backups can’t be created of ten enough to meet low
RPOs, and recovery takes too long to meet RTO requirements.
As demonstrated in this document, in most cases NetApp AFF performance exceeds that of DAS. It has
also been demonstrated that backups can be created almost instantaneously by using NetApp Snapshot
technology, that those backups require very little storage space, and that they can be used to quickly
recover a Splunk system from catastrophic data loss. In addition, it has been shown that Snapshot copy
creation has zero impact on performance and is completely nondisruptive. The resilience of NetApp
storage was also demonstrated: A panic condition was created on one of the storage controllers, with
zero impact on availability and zero impact on performance.
Note: Based on workload, there could be a small impact of short duration on performance, but that was not observed during the tests.
In addition to controller failover testing, a disk failure test was performed, which resulted in zero impact on
performance or on Splunk availability. ONTAP storage efficiency offers another valuable feature: a 2:1
32 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
savings in storage utilization because of ONTAP inline deduplication and compression, as well as an
additional 2:1 savings without the traditional disk mirroring recommended by Splunk. Finally, the ability to
create instant, free data copies by using FlexClone technology, a key feature for support of DevOps, was
demonstrated.
The proof points and test results described in this document clearly demonstrate that by decoupling
compute from storage and implementing NetApp AFF storage in Splunk deployments, the following
results are achieved:
• Higher performance
• A reduction in server requirements
• A reduction in storage requirements
• A more robust Splunk configuration
• Enterprise-class data protection
• Faster recovery from data loss
• Consistent performance, even in the event of storage hardware failure
These results mean reduced costs for power and data center floor space, and a significant increase in
system reliability and availability. There is no room for compromise on Splunk system reliability and
availability, especially in the areas of healthcare and security. In those environments, Splunk system
downtime, at worst case, can result in loss of life and/or significant financial loss. NetApp AFF storage
powered by ONTAP 9 is the logical choice for Splunk.
Appendix A: Storage Configuration
Output for df -S Command
The following is the output for the df- S command:
stlaurora-7and8::> df -S
Filesystem used total-saved %total-saved deduplicated %deduplicated
compressed %compressed Vserver
/vol/nfs_stlrx2540m1_74_splunk_index_vol1/ 6266288 978212 14% 28628 0%
949584 13% splunksvm
/vol/nfs_stlrx2540m1_75_splunk_index_vol1/ 6664096 917132 12% 34276 0%
882856 12% splunksvm
/vol/nfs_stlrx2540m1_76_splunk_index_vol1/ 5364284 713024 12% 26424 0%
686600 11% splunksvm
/vol/nfs_stlrx2540m1_77_splunk_index_vol1/ 6339364 1036556 14% 28172 0%
1008384 14% splunksvm
/vol/nfs_stlrx2540m1_78_splunk_index_vol1/ 632 16 2% 0 0%
16 2% splunksvm
/vol/nfs_stlrx2540m1_79_splunk_index_vol1/ 540 0 0% 0 0%
0 0% splunksvm
/vol/nfs_stlrx2540m1_80_splunk_index_vol1/ 648 4 1% 0 0%
4 1% splunksvm
/vol/nfs_stlrx2540m1_81_splunk_index_vol1/ 516 0 0% 0 0%
0 0% splunksvm
/vol/splunksvm_root/ 1340 0 0% 0 0%
0 0% splunksvm
/vol/stlrx2540m1_74_splunk_index_vol1/ 561447260 35944712 6% 2243692 0%
33701020 6% splunksvm
/vol/stlrx2540m1_74_splunk_index_vol1_clone_07112017_152639_99/ 548775764 35440456 6% 2272236 0%
33168220 6% splunksvm
/vol/stlrx2540m1_75_splunk_index_vol2/ 563322960 26128084 4% 914360 0%
25213724 4% splunksvm
/vol/stlrx2540m1_75_splunk_index_vol2_clone_07112017_153925_14/ 555004788 26128084 4% 914360 0%
25213724 4% splunksvm
/vol/stlrx2540m1_76_splunk_index_vol3/ 566148880 24716876 4% 1046596 0%
23670280 4% splunksvm
33 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
/vol/stlrx2540m1_76_splunk_index_vol3_clone_07112017_153944_56/ 554413108 24716876 4% 1046596 0%
23670280 4% splunksvm
/vol/stlrx2540m1_77_splunk_index_vol4/ 561310644 25805200 4% 1209868 0%
24595332 4% splunksvm
/vol/stlrx2540m1_77_splunk_index_vol4_clone_07112017_154003_90/ 553761456 25805200 4% 1209868 0%
24595332 4% splunksvm
/vol/stlrx2540m1_78_splunk_index_vol5/ 564637812 22971176 4% 876596 0%
22094580 4% splunksvm
/vol/stlrx2540m1_79_splunk_index_vol6/ 566874448 24309068 4% 932648 0%
23376420 4% splunksvm
/vol/stlrx2540m1_80_splunk_index_vol7/ 565417500 23032416 4% 1165924 0%
21866492 4% splunksvm
/vol/stlrx2540m1_81_splunk_index_vol8/ 561617444 23099432 4% 1093244 0%
22006188 4% splunksvm
/vol/stlrx2540m1_82_splunk_frd_vol1/ 344507716 261055792 43% 80631120 13%
180424672 30% splunksvm
/vol/stlrx2540m1_83_splunk_frd_vol2/ 298018488 297482956 50% 113276172 19%
184206784 31% splunksvm
/vol/stlrx2540m1_84_splunk_frd_vol3/ 421337732 178440444 30% 54261852 9%
124178592 21% splunksvm
/vol/stlrx2540m1_85_splunk_cntl_mon_vol1/ 578873448 129860 0% 129124 0%
736 0% splunksvm
/vol/stlrx2540m1_86_splunk_search_head_vol1/ 578873468 129768 0% 129124 0%
644 0% splunksvm
/vol/vol0/ 121413276 0 0% 0 0%
0 0% stlaurora-7and8-01
/vol/vol0/ 23125368 0 0% 0 0%
0 0% stlaurora-7and8-02
28 entries were displayed.
Output for df -A -S Command
The following is the output for the df -A -S command:
stlaurora-7and8::> df -A -S
Aggregate used total-saved %total-saved deduplicated %deduplicated
compressed %compressed
aggr0 990430988 0 0% 0 0%
0 0%
aggr0_stlaurora_7and8_02_0 990426232 0 0% 0 0%
0 0%
aggr1 894099384 77076012 8% 77076012 8%
0 0%
aggr2 753548556 164489668 18% 164489668 18%
0 0%
4 entries were displayed.
Output for lun show Command
The following is the output for the lun show command:
stlaurora-7and8::> lun show
Vserver Path State Mapped Type Size
--------- ------------------------------- ------- -------- -------- --------
splunksvm /vol/stlrx2540m1_74_splunk_index_vol1/stlrx2540m1-74_lun1
online unmapped linux 550.0GB
splunksvm /vol/stlrx2540m1_74_splunk_index_vol1_clone_07112017_152639_99/stlrx2540m1-74_lun1
online mapped linux 550.0GB
splunksvm /vol/stlrx2540m1_75_splunk_index_vol2/stlrx2540m1-75_lun1
online mapped linux 550.0GB
splunksvm /vol/stlrx2540m1_75_splunk_index_vol2_clone_07112017_153925_14/stlrx2540m1-75_lun1
online unmapped linux 550.0GB
splunksvm /vol/stlrx2540m1_76_splunk_index_vol3/stlrx2540m1-76_lun1
online mapped linux 550.0GB
splunksvm /vol/stlrx2540m1_76_splunk_index_vol3_clone_07112017_153944_56/stlrx2540m1-76_lun1
online unmapped linux 550.0GB
splunksvm /vol/stlrx2540m1_77_splunk_index_vol4/stlrx2540m1-77_lin1
online mapped linux 550.0GB
34 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
splunksvm /vol/stlrx2540m1_77_splunk_index_vol4_clone_07112017_154003_90/stlrx2540m1-77_lin1
online unmapped linux 550.0GB
splunksvm /vol/stlrx2540m1_78_splunk_index_vol5/stlrx2540m1_78_lun1
online mapped linux 550.0GB
splunksvm /vol/stlrx2540m1_79_splunk_index_vol6/stlrx2540m1-79_lun1
online mapped linux 550.0GB
splunksvm /vol/stlrx2540m1_80_splunk_index_vol7/stlrx2540m1-80_lun1
online mapped linux 550.0GB
Vserver Path State Mapped Type Size
--------- ------------------------------- ------- -------- -------- --------
splunksvm /vol/stlrx2540m1_81_splunk_index_vol8/stlrx2540m1-81_lun1
online mapped linux 550.0GB
splunksvm /vol/stlrx2540m1_82_splunk_frd_vol1/stlrx2540m1-82_lun1
online mapped linux 550.0GB
splunksvm /vol/stlrx2540m1_83_splunk_frd_vol2/stlrx2540m1-83_lun1
online mapped linux 550.0GB
splunksvm /vol/stlrx2540m1_84_splunk_frd_vol3/stlrx2540m1-84_lun1
online mapped linux 550.0GB
splunksvm /vol/stlrx2540m1_85_splunk_cntl_mon_vol1/stlrx2540m1-85_lun1
online mapped linux 550.0GB
splunksvm /vol/stlrx2540m1_86_splunk_search_head_vol1/stlrx2540m1-86_lun1
online mapped linux 550.0GB
17 entries were displayed.
Output for sysconfig -r Command on Storage Node 01
The following is the output for the sysconfig -r command on node 01:
stlaurora-7and8::> node run -node stlaurora-7and8-0
stlaurora-7and8-01 stlaurora-7and8-02
stlaurora-7and8::> node run -node stlaurora-7and8-01 sysconfig -r
Aggregate aggr0 (online, raid_dp) (block checksums)
Plex /aggr0/plex0 (online, normal, active, pool0)
RAID group /aggr0/plex0/rg0 (normal, block checksums)
RAID Disk Device HA SHELF BAY CHAN Pool Type RPM Used (MB/blks) Phys
(MB/blks)
--------- ------ ------------- ---- ---- ---- ----- -------------- ------------
--
dparity 0a.00.0P3 0a 0 0 SA:A 0 SSD N/A 148628/304391168
148636/304407552
parity 0b.00.1P3 0b 0 1 SA:A 0 SSD N/A 148628/304391168
148636/304407552
data 0c.00.2P3 0c 0 2 SA:A 0 SSD N/A 148628/304391168
148636/304407552
data 0d.00.3P3 0d 0 3 SA:A 0 SSD N/A 148628/304391168
148636/304407552
data 0c.00.10P3 0c 0 10 SA:A 0 SSD N/A 148628/304391168
148636/304407552
data 0b.00.5P3 0b 0 5 SA:A 0 SSD N/A 148628/304391168
148636/304407552
data 0c.00.6P3 0c 0 6 SA:A 0 SSD N/A 148628/304391168
148636/304407552
data 0d.00.7P3 0d 0 7 SA:A 0 SSD N/A 148628/304391168
148636/304407552
data 0a.00.8P3 0a 0 8 SA:A 0 SSD N/A 148628/304391168
148636/304407552
data 0b.00.9P3 0b 0 9 SA:A 0 SSD N/A 148628/304391168
148636/304407552
Aggregate aggr1 (online, raid_dp) (block checksums)
Plex /aggr1/plex0 (online, normal, active, pool0)
RAID group /aggr1/plex0/rg0 (normal, block checksums)
RAID Disk Device HA SHELF BAY CHAN Pool Type RPM Used (MB/blks) Phys
(MB/blks)
--------- ------ ------------- ---- ---- ---- ----- -------------- ------------
--
35 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
dparity 0a.00.0P1 0a 0 0 SA:A 0 SSD N/A 383396/785195008
383404/785211392
parity 0b.00.1P1 0b 0 1 SA:A 0 SSD N/A 383396/785195008
383404/785211392
data 0c.00.2P1 0c 0 2 SA:A 0 SSD N/A 383396/785195008
383404/785211392
data 0d.00.3P1 0d 0 3 SA:A 0 SSD N/A 383396/785195008
383404/785211392
data 0d.00.19P1 0d 0 19 SA:A 0 SSD N/A 383396/785195008
383404/785211392
data 0b.00.5P1 0b 0 5 SA:A 0 SSD N/A 383396/785195008
383404/785211392
data 0c.00.6P1 0c 0 6 SA:A 0 SSD N/A 383396/785195008
383404/785211392
data 0d.00.7P1 0d 0 7 SA:A 0 SSD N/A 383396/785195008
383404/785211392
data 0a.00.8P1 0a 0 8 SA:A 0 SSD N/A 383396/785195008
383404/785211392
data 0b.00.9P1 0b 0 9 SA:A 0 SSD N/A 383396/785195008
383404/785211392
data 0a.00.12P1 0a 0 12 SA:A 0 SSD N/A 383396/785195008
383404/785211392
data 0b.00.13P1 0b 0 13 SA:A 0 SSD N/A 383396/785195008
383404/785211392
data 0c.00.14P1 0c 0 14 SA:A 0 SSD N/A 383396/785195008
383404/785211392
data 0a.00.4P1 0a 0 4 SA:A 0 SSD N/A 383396/785195008
383404/785211392
data 0a.00.16P1 0a 0 16 SA:A 0 SSD N/A 383396/785195008
383404/785211392
data 0b.00.17P1 0b 0 17 SA:A 0 SSD N/A 383396/785195008
383404/785211392
data 0c.00.18P1 0c 0 18 SA:A 0 SSD N/A 383396/785195008
383404/785211392
data 0d.00.23P1 0d 0 23 SA:A 0 SSD N/A 383396/785195008
383404/785211392
data 0a.00.20P1 0a 0 20 SA:A 0 SSD N/A 383396/785195008
383404/785211392
data 0b.00.21P1 0b 0 21 SA:A 0 SSD N/A 383396/785195008
383404/785211392
data 0c.00.10P1 0c 0 10 SA:A 0 SSD N/A 383396/785195008
383404/785211392
data 0d.00.11P1 0d 0 11 SA:A 0 SSD N/A 383396/785195008
383404/785211392
data 0c.00.22P1 0c 0 22 SA:A 0 SSD N/A 383396/785195008
383404/785211392
Pool1 spare disks (empty)
Pool0 spare disks
RAID Disk Device HA SHELF BAY CHAN Pool Type RPM Used (MB/blks) Phys
(MB/blks)
--------- ------ ------------- ---- ---- ---- ----- -------------- ------------
--
Spare disks for block checksum
spare 0a.00.4P3 0a 0 4 SA:A 0 SSD N/A 148628/304391168
148636/304407552 (not zeroed)
spare 0d.00.11P3 0d 0 11 SA:A 0 SSD N/A 148628/304391168
148636/304407552
spare 0d.00.15P1 0d 0 15 SA:A 0 SSD N/A 383396/785195008
383404/785211392 (not zeroed)
Partner disks
RAID Disk Device HA SHELF BAY CHAN Pool Type RPM Used (MB/blks) Phys
(MB/blks)
--------- ------ ------------- ---- ---- ---- ----- -------------- ------------
--
36 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
partner 0d.00.15P3 0d 0 15 SA:A 0 SSD N/A 0/0
148636/304407552
partner 0d.00.15P2 0d 0 15 SA:A 0 SSD N/A 0/0
383404/785211392
partner 0a.00.20P3 0a 0 20 SA:A 0 SSD N/A 0/0
148636/304407552
partner 0d.00.3P2 0d 0 3 SA:A 0 SSD N/A 0/0
383404/785211392
partner 0d.00.19P3 0d 0 19 SA:A 0 SSD N/A 0/0
148636/304407552
partner 0d.00.7P2 0d 0 7 SA:A 0 SSD N/A 0/0
383404/785211392
partner 0c.00.14P3 0c 0 14 SA:A 0 SSD N/A 0/0
148636/304407552
partner 0c.00.22P3 0c 0 22 SA:A 0 SSD N/A 0/0
148636/304407552
partner 0d.00.23P3 0d 0 23 SA:A 0 SSD N/A 0/0
148636/304407552
partner 0b.00.21P3 0b 0 21 SA:A 0 SSD N/A 0/0
148636/304407552
partner 0b.00.21P2 0b 0 21 SA:A 0 SSD N/A 0/0
383404/785211392
partner 0a.00.16P3 0a 0 16 SA:A 0 SSD N/A 0/0
148636/304407552
partner 0a.00.16P2 0a 0 16 SA:A 0 SSD N/A 0/0
383404/785211392
partner 0b.00.1P2 0b 0 1 SA:A 0 SSD N/A 0/0
383404/785211392
partner 0b.00.9P2 0b 0 9 SA:A 0 SSD N/A 0/0
383404/785211392
partner 0a.00.20P2 0a 0 20 SA:A 0 SSD N/A 0/0
383404/785211392
partner 0b.00.17P2 0b 0 17 SA:A 0 SSD N/A 0/0
383404/785211392
partner 0b.00.17P3 0b 0 17 SA:A 0 SSD N/A 0/0
148636/304407552
partner 0c.00.22P2 0c 0 22 SA:A 0 SSD N/A 0/0
383404/785211392
partner 0d.00.23P2 0d 0 23 SA:A 0 SSD N/A 0/0
383404/785211392
partner 0c.00.10P2 0c 0 10 SA:A 0 SSD N/A 0/0
383404/785211392
partner 0c.00.14P2 0c 0 14 SA:A 0 SSD N/A 0/0
383404/785211392
partner 0a.00.0P2 0a 0 0 SA:A 0 SSD N/A 0/0
383404/785211392
partner 0b.00.13P3 0b 0 13 SA:A 0 SSD N/A 0/0
148636/304407552
partner 0b.00.13P2 0b 0 13 SA:A 0 SSD N/A 0/0
383404/785211392
partner 0b.00.5P2 0b 0 5 SA:A 0 SSD N/A 0/0
383404/785211392
partner 0a.00.8P2 0a 0 8 SA:A 0 SSD N/A 0/0
383404/785211392
partner 0c.00.18P3 0c 0 18 SA:A 0 SSD N/A 0/0
148636/304407552
partner 0c.00.18P2 0c 0 18 SA:A 0 SSD N/A 0/0
383404/785211392
partner 0c.00.2P2 0c 0 2 SA:A 0 SSD N/A 0/0
383404/785211392
partner 0d.00.19P2 0d 0 19 SA:A 0 SSD N/A 0/0
383404/785211392
partner 0a.00.12P3 0a 0 12 SA:A 0 SSD N/A 0/0
148636/304407552
partner 0a.00.12P2 0a 0 12 SA:A 0 SSD N/A 0/0
383404/785211392
partner 0c.00.6P2 0c 0 6 SA:A 0 SSD N/A 0/0
383404/785211392
partner 0d.00.11P2 0d 0 11 SA:A 0 SSD N/A 0/0
383404/785211392
37 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
partner 0a.00.4P2 0a 0 4 SA:A 0 SSD N/A 0/0
383404/785211392
Output for sysconfig -r Command for Storage Node 02
The following is the output for the sysconfig -r command for node 02:
stlaurora-7and8::> node run -node stlaurora-7and8-02 sysconfig -r
Aggregate aggr2 (online, raid_dp) (block checksums)
Plex /aggr2/plex0 (online, normal, active, pool0)
RAID group /aggr2/plex0/rg0 (normal, block checksums)
RAID Disk Device HA SHELF BAY CHAN Pool Type RPM Used (MB/blks) Phys
(MB/blks)
--------- ------ ------------- ---- ---- ---- ----- -------------- ------------
--
dparity 0a.00.12P2 0a 0 12 SA:B 0 SSD N/A 383396/785195008
383404/785211392
parity 0b.00.13P2 0b 0 13 SA:B 0 SSD N/A 383396/785195008
383404/785211392
data 0c.00.14P2 0c 0 14 SA:B 0 SSD N/A 383396/785195008
383404/785211392
data 0a.00.4P2 0a 0 4 SA:B 0 SSD N/A 383396/785195008
383404/785211392
data 0a.00.16P2 0a 0 16 SA:B 0 SSD N/A 383396/785195008
383404/785211392
data 0b.00.17P2 0b 0 17 SA:B 0 SSD N/A 383396/785195008
383404/785211392
data 0c.00.18P2 0c 0 18 SA:B 0 SSD N/A 383396/785195008
383404/785211392
data 0d.00.23P2 0d 0 23 SA:B 0 SSD N/A 383396/785195008
383404/785211392
data 0a.00.20P2 0a 0 20 SA:B 0 SSD N/A 383396/785195008
383404/785211392
data 0b.00.21P2 0b 0 21 SA:B 0 SSD N/A 383396/785195008
383404/785211392
data 0a.00.0P2 0a 0 0 SA:B 0 SSD N/A 383396/785195008
383404/785211392
data 0b.00.1P2 0b 0 1 SA:B 0 SSD N/A 383396/785195008
383404/785211392
data 0c.00.2P2 0c 0 2 SA:B 0 SSD N/A 383396/785195008
383404/785211392
data 0d.00.3P2 0d 0 3 SA:B 0 SSD N/A 383396/785195008
383404/785211392
data 0d.00.19P2 0d 0 19 SA:B 0 SSD N/A 383396/785195008
383404/785211392
data 0b.00.5P2 0b 0 5 SA:B 0 SSD N/A 383396/785195008
383404/785211392
data 0c.00.6P2 0c 0 6 SA:B 0 SSD N/A 383396/785195008
383404/785211392
data 0d.00.7P2 0d 0 7 SA:B 0 SSD N/A 383396/785195008
383404/785211392
data 0a.00.8P2 0a 0 8 SA:B 0 SSD N/A 383396/785195008
383404/785211392
data 0b.00.9P2 0b 0 9 SA:B 0 SSD N/A 383396/785195008
383404/785211392
data 0c.00.10P2 0c 0 10 SA:B 0 SSD N/A 383396/785195008
383404/785211392
data 0d.00.11P2 0d 0 11 SA:B 0 SSD N/A 383396/785195008
383404/785211392
data 0c.00.22P2 0c 0 22 SA:B 0 SSD N/A 383396/785195008
383404/785211392
Aggregate aggr0_stlaurora_7and8_02_0 (online, raid_dp) (block checksums)
Plex /aggr0_stlaurora_7and8_02_0/plex0 (online, normal, active, pool0)
RAID group /aggr0_stlaurora_7and8_02_0/plex0/rg0 (normal, block checksums)
RAID Disk Device HA SHELF BAY CHAN Pool Type RPM Used (MB/blks) Phys
(MB/blks)
38 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
--------- ------ ------------- ---- ---- ---- ----- -------------- ------------
--
dparity 0a.00.12P3 0a 0 12 SA:B 0 SSD N/A 148628/304391168
148636/304407552
parity 0b.00.13P3 0b 0 13 SA:B 0 SSD N/A 148628/304391168
148636/304407552
data 0c.00.14P3 0c 0 14 SA:B 0 SSD N/A 148628/304391168
148636/304407552
data 0d.00.23P3 0d 0 23 SA:B 0 SSD N/A 148628/304391168
148636/304407552
data 0a.00.16P3 0a 0 16 SA:B 0 SSD N/A 148628/304391168
148636/304407552
data 0b.00.17P3 0b 0 17 SA:B 0 SSD N/A 148628/304391168
148636/304407552
data 0c.00.18P3 0c 0 18 SA:B 0 SSD N/A 148628/304391168
148636/304407552
data 0c.00.22P3 0c 0 22 SA:B 0 SSD N/A 148628/304391168
148636/304407552
data 0a.00.20P3 0a 0 20 SA:B 0 SSD N/A 148628/304391168
148636/304407552
data 0b.00.21P3 0b 0 21 SA:B 0 SSD N/A 148628/304391168
148636/304407552
Pool1 spare disks (empty)
Pool0 spare disks
RAID Disk Device HA SHELF BAY CHAN Pool Type RPM Used (MB/blks) Phys
(MB/blks)
--------- ------ ------------- ---- ---- ---- ----- -------------- ------------
--
Spare disks for block checksum
spare 0d.00.15P3 0d 0 15 SA:B 0 SSD N/A 148628/304391168
148636/304407552 (not zeroed)
spare 0d.00.19P3 0d 0 19 SA:B 0 SSD N/A 148628/304391168
148636/304407552 (not zeroed)
spare 0d.00.15P2 0d 0 15 SA:B 0 SSD N/A 383396/785195008
383404/785211392 (not zeroed)
Partner disks
RAID Disk Device HA SHELF BAY CHAN Pool Type RPM Used (MB/blks) Phys
(MB/blks)
--------- ------ ------------- ---- ---- ---- ----- -------------- ------------
--
partner 0c.00.22P1 0c 0 22 SA:B 0 SSD N/A 383396/785195008
383404/785211392
partner 0d.00.11P1 0d 0 11 SA:B 0 SSD N/A 383396/785195008
383404/785211392
partner 0c.00.10P1 0c 0 10 SA:B 0 SSD N/A 383396/785195008
383404/785211392
partner 0b.00.21P1 0b 0 21 SA:B 0 SSD N/A 383396/785195008
383404/785211392
partner 0a.00.20P1 0a 0 20 SA:B 0 SSD N/A 383396/785195008
383404/785211392
partner 0d.00.23P1 0d 0 23 SA:B 0 SSD N/A 383396/785195008
383404/785211392
partner 0c.00.18P1 0c 0 18 SA:B 0 SSD N/A 383396/785195008
383404/785211392
partner 0b.00.17P1 0b 0 17 SA:B 0 SSD N/A 383396/785195008
383404/785211392
partner 0a.00.16P1 0a 0 16 SA:B 0 SSD N/A 383396/785195008
383404/785211392
partner 0d.00.15P1 0d 0 15 SA:B 0 SSD N/A 383396/785195008
383404/785211392
partner 0c.00.14P1 0c 0 14 SA:B 0 SSD N/A 383396/785195008
383404/785211392
partner 0b.00.13P1 0b 0 13 SA:B 0 SSD N/A 383396/785195008
383404/785211392
39 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
partner 0a.00.12P1 0a 0 12 SA:B 0 SSD N/A 383396/785195008
383404/785211392
partner 0b.00.9P1 0b 0 9 SA:B 0 SSD N/A 383396/785195008
383404/785211392
partner 0a.00.8P1 0a 0 8 SA:B 0 SSD N/A 383396/785195008
383404/785211392
partner 0d.00.7P1 0d 0 7 SA:B 0 SSD N/A 383396/785195008
383404/785211392
partner 0c.00.6P1 0c 0 6 SA:B 0 SSD N/A 383396/785195008
383404/785211392
partner 0b.00.5P1 0b 0 5 SA:B 0 SSD N/A 383396/785195008
383404/785211392
partner 0d.00.19P1 0d 0 19 SA:B 0 SSD N/A 383396/785195008
383404/785211392
partner 0d.00.3P1 0d 0 3 SA:B 0 SSD N/A 383396/785195008
383404/785211392
partner 0c.00.2P1 0c 0 2 SA:B 0 SSD N/A 383396/785195008
383404/785211392
partner 0b.00.1P1 0b 0 1 SA:B 0 SSD N/A 383396/785195008
383404/785211392
partner 0a.00.0P1 0a 0 0 SA:B 0 SSD N/A 383396/785195008
383404/785211392
partner 0a.00.4P1 0a 0 4 SA:B 0 SSD N/A 0/0
383404/785211392
partner 0d.00.11P3 0d 0 11 SA:B 0 SSD N/A 0/0
148636/304407552
partner 0b.00.1P3 0b 0 1 SA:B 0 SSD N/A 0/0
148636/304407552
partner 0b.00.5P3 0b 0 5 SA:B 0 SSD N/A 0/0
148636/304407552
partner 0b.00.9P3 0b 0 9 SA:B 0 SSD N/A 0/0
148636/304407552
partner 0a.00.8P3 0a 0 8 SA:B 0 SSD N/A 0/0
148636/304407552
partner 0a.00.4P3 0a 0 4 SA:B 0 SSD N/A 0/0
148636/304407552
partner 0a.00.0P3 0a 0 0 SA:B 0 SSD N/A 0/0
148636/304407552
partner 0d.00.3P3 0d 0 3 SA:B 0 SSD N/A 0/0
148636/304407552
partner 0c.00.2P3 0c 0 2 SA:B 0 SSD N/A 0/0
148636/304407552
partner 0c.00.10P3 0c 0 10 SA:B 0 SSD N/A 0/0
148636/304407552
partner 0d.00.7P3 0d 0 7 SA:B 0 SSD N/A 0/0
148636/304407552
partner 0c.00.6P3 0c 0 6 SA:B 0 SSD N/A 0/0
148636/304407552
Output for sysconfig -a Command for Storage Node 01
The following is the output for the sysconfig -a command for node 01:
stlaurora-7and8::> node run -node stlaurora-7and8-01 sysconfig -a
NetApp Release 9.2: Mon Jun 19 20:23:37 PDT 2017
System ID: 0537051946 (stlaurora-7and8-01); partner ID: 0537051915 (stlaurora-7and8-02)
System Serial Number: 23380268F01C (stlaurora-7and8-01)
System Rev: 10
System Storage Configuration: Quad-Path HA
System ACP Connectivity: Inband Active
All-Flash Optimized: true
Backplane Part Number: 1A42CRB00+10
Backplane Serial Number: 2CRB0267M00D
slot 0: System Board 2.3 GHz (System Board XXIII 10)
Model Name: AFF-A700s
Part Number: TEMP-S000092338
Revision: 10
Serial Number: 2BJJ0267S043
BIOS version: 12.0
Loader version: 6.1
40 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
Processors: 36
Processor ID: 0x406f1
Microcode Version: 0xb00001d
Processor type: Intel(R) Xeon(R) CPU E5-2697 v4 @ 2.30GHz
Memory Size: 524288 MB
Memory Attributes: Node Interleaving
Hoisting
Rank Interleaving
Channel Interleaving
Chipkill ECC
Controller: A
Service Processor Status: Online
Firmware Version: 1.12
Mgmt MAC Address: 00:a0:98:ad:ad:2a
Ethernet Link: up
Using DHCP: yes
IPv4 configuration:
IP Address: 10.63.158.146
Netmask: 255.255.255.0
Gateway: 10.63.158.1
IPv6 configuration:
Global IP: ::
Prefix Length: 0
Gateway: ::
Router Assigned IP: 0.0.0.0
Link Local IP: 0.0.0.0
slot 0: Gigabit Ethernet I210
e0M MAC Address: 00:a0:98:af:90:53 (auto-1000t-fd-up)
Device Type: 1533
Firmware Version: 3.25-3.1 0x800005CD
slot 0: Gigabit Ethernet Controller 82580
e0S MAC Address: 00:a0:98:af:90:54 (auto-1000t-fd-up)
Device Type: 1537
Firmware Version: 3.19 0x800005DB
slot 0: 40 Gigabit Ethernet Controller XL710 QSFP+
e0a MAC Address: 90:e2:ba:cf:17:88 (auto-40g_cr4-fd-up)
QSFP Vendor: CISCO-TYCO
QSFP Part Number: 2821248-3
QSFP Serial Number: TED2033JMG6-A
e0e MAC Address: 90:e2:ba:cf:17:89 (auto-unknown-fd-down)
QSFP Vendor:
QSFP Part Number:
QSFP Serial Number:
e0f MAC Address: 90:e2:ba:cf:14:e8 (auto-40g_cr4-fd-up)
QSFP Vendor: CISCO-TYCO
QSFP Part Number: 2821248-3
QSFP Serial Number: TED2033JMHH-A
e0j MAC Address: 90:e2:ba:cf:14:e9 (auto-unknown-fd-down)
QSFP Vendor:
QSFP Part Number:
QSFP Serial Number:
Device Type: XL710 4, PBA H52289-006, PBA H52289-006
Firmware Version: fw 5.0 nvm 5.04 etid 800028f4
slot 0: NVMe Boot Media #1 (0x144d,0xa802)
Boot Media #1 SAMSUNG MZVLV128HCGR-00000 BXV7000Q 119GB 512B/sect
(S2J4NX0H507801)
slot 0: NVMe Boot Media #2 (0x144d,0xa802)
Boot Media #2 SAMSUNG MZVLV128HCGR-00000 BXV7000Q 119GB 512B/sect
(S2J4NX0H507804)
slot 0: SAS Host Adapter 0a (Avago Technologies SAS3008 rev. 2, SAS, <UP>)
Firmware rev: 13.00.00.00
NVDATA rev: 11.02.17.08
Base WWN: 5:1c666d:0010094:f8
Phy State: [0] Enabled, 12.0 Gb/s
[1] Enabled, 12.0 Gb/s
[2] Enabled, 12.0 Gb/s
[3] Enabled, 12.0 Gb/s
00.0 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900214)
00.1 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801588)
00.2 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901365)
00.3 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904782)
41 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
00.4 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901366)
00.5 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901392)
00.6 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900961)
00.7 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900560)
00.8 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901386)
00.9 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901371)
00.10: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900521)
00.11: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801200)
00.12: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H903553)
00.13: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904781)
00.14: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900248)
00.15: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800957)
00.16: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900816)
00.17: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800413)
00.18: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904776)
00.19: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900265)
00.20: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900759)
00.21: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900864)
00.22: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901382)
00.23: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901388)
Shelf 0: FS424-12 Firmware rev. IOM12F A: 0110 IOM12F B: 0110
slot 0: SAS Host Adapter 0b (Avago Technologies SAS3008 rev. 2, SAS, <UP>)
Firmware rev: 13.00.00.00
NVDATA rev: 11.02.17.08
Base WWN: 5:1c666d:0010094:fc
Phy State: [0] Enabled, 12.0 Gb/s
[1] Enabled, 12.0 Gb/s
[2] Enabled, 12.0 Gb/s
[3] Enabled, 12.0 Gb/s
00.0 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900214)
00.1 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801588)
00.2 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901365)
00.3 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904782)
00.4 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901366)
00.5 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901392)
00.6 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900961)
00.7 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900560)
00.8 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901386)
00.9 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901371)
00.10: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900521)
00.11: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801200)
00.12: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H903553)
00.13: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904781)
00.14: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900248)
00.15: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800957)
00.16: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900816)
00.17: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800413)
00.18: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904776)
00.19: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900265)
00.20: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900759)
00.21: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900864)
00.22: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901382)
00.23: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901388)
Shelf 0: FS424-12 Firmware rev. IOM12F A: 0110 IOM12F B: 0110
slot 0: SAS Host Adapter 0c (Avago Technologies SAS3008 rev. 2, SAS, <UP>)
Firmware rev: 13.00.00.00
NVDATA rev: 11.02.01.08
Base WWN: 5:1c666d:0010094:f0
Phy State: [0] Enabled, 12.0 Gb/s
[1] Enabled, 12.0 Gb/s
[2] Enabled, 12.0 Gb/s
[3] Enabled, 12.0 Gb/s
00.0 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900214)
00.1 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801588)
00.2 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901365)
00.3 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904782)
00.4 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901366)
00.5 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901392)
00.6 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900961)
00.7 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900560)
00.8 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901386)
42 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
00.9 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901371)
00.10: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900521)
00.11: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801200)
00.12: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H903553)
00.13: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904781)
00.14: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900248)
00.15: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800957)
00.16: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900816)
00.17: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800413)
00.18: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904776)
00.19: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900265)
00.20: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900759)
00.21: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900864)
00.22: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901382)
00.23: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901388)
Shelf 0: FS424-12 Firmware rev. IOM12F A: 0110 IOM12F B: 0110
slot 0: SAS Host Adapter 0d (Avago Technologies SAS3008 rev. 2, SAS, <UP>)
Firmware rev: 13.00.00.00
NVDATA rev: 11.02.01.08
Base WWN: 5:1c666d:0010094:f4
Phy State: [0] Enabled, 12.0 Gb/s
[1] Enabled, 12.0 Gb/s
[2] Enabled, 12.0 Gb/s
[3] Enabled, 12.0 Gb/s
00.0 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900214)
00.1 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801588)
00.2 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901365)
00.3 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904782)
00.4 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901366)
00.5 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901392)
00.6 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900961)
00.7 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900560)
00.8 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901386)
00.9 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901371)
00.10: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900521)
00.11: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801200)
00.12: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H903553)
00.13: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904781)
00.14: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900248)
00.15: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800957)
00.16: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900816)
00.17: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800413)
00.18: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904776)
00.19: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900265)
00.20: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900759)
00.21: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900864)
00.22: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901382)
00.23: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901388)
Shelf 0: FS424-12 Firmware rev. IOM12F A: 0110 IOM12F B: 0110
slot 0: Intel USB EHCI Adapter u0b (0xc7f00000)
slot 1: NVRAM (NVRAM 10-P)
Revision: 20
Serial Number: 031627002032
DIMM Size: 16384 MB
Memory Size: 16384 MB
Battery Status: Battery sufficiently charged
Running Firmware: 1.1.5
slot 1: Interconnect HBA: Generic OFED Provider
Port Name: ic1a
GID: fe80:0000:0000:0000:0000:0000:0000:0104
Base LID: 0x104
Active MTU: 8192
slot 1: HSL Interconnect
Data Rate: 80 Gb/s (8X)
Link State: ACTIVE
QSFP Vendor: Molex Inc.
QSFP Part Number: 112-00435+A0
QSFP Type: Passive Copper 1m ID:00
QSFP Serial Number: 615630503
QSFP Vendor: Molex Inc.
QSFP Part Number: 112-00435+A0
43 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
QSFP Type: Passive Copper 1m ID:00
QSFP Serial Number: 615630404
slot 2: Fibre Channel Target Host Adapter 2a
(Emulex LPe32000 (LPe32002) rev. 12, <ONLINE>)
Board Name: 111-03249
Serial Number: FC62671468
Firmware rev: 11.1.219.4
Host Port Addr: 010000
FC Nodename: 50:0a:09:80:80:d2:c3:2a (500a098080d2c32a)
FC Portname: 50:0a:09:81:80:d2:c3:2a (500a098180d2c32a)
Connection: PTP, Fabric
Switch Port: stlbrcd6510-25:0
SFP Vendor Name: FINISAR CORP.
SFP Vendor P/N: FTLF8532P4BCV-EM
SFP Vendor Rev: A
SFP Serial No.: UVK1P6P
SFP Connector: LC
SFP Capabilities: 8, 16, 32 Gbit/Sec
slot 2: Fibre Channel Target Host Adapter 2b
(Emulex LPe32000 (LPe32002) rev. 12, <ONLINE>)
Board Name: 111-03249
Serial Number: FC62671468
Firmware rev: 11.1.219.4
Host Port Addr: 010000
FC Nodename: 50:0a:09:80:80:d2:c3:2a (500a098080d2c32a)
FC Portname: 50:0a:09:82:80:d2:c3:2a (500a098280d2c32a)
Connection: PTP, Fabric
Switch Port: stlbrcd6510-26:0
SFP Vendor Name: FINISAR CORP.
SFP Vendor P/N: FTLF8532P4BCV-EM
SFP Vendor Rev: A
SFP Serial No.: UVK1P6Q
SFP Connector: LC
SFP Capabilities: 8, 16, 32 Gbit/Sec
slot 3: Fibre Channel Target Host Adapter 3a
(Emulex LPe32000 (LPe32002) rev. 12, <ONLINE>)
Board Name: 111-03249
Serial Number: FC62671433
Firmware rev: 11.1.219.4
Host Port Addr: 010100
FC Nodename: 50:0a:09:80:80:d2:c3:2a (500a098080d2c32a)
FC Portname: 50:0a:09:83:80:d2:c3:2a (500a098380d2c32a)
Connection: PTP, Fabric
Switch Port: stlbrcd6510-25:1
SFP Vendor Name: FINISAR CORP.
SFP Vendor P/N: FTLF8532P4BCV-EM
SFP Vendor Rev: A
SFP Serial No.: UVK1LPK
SFP Connector: LC
SFP Capabilities: 8, 16, 32 Gbit/Sec
slot 3: Fibre Channel Target Host Adapter 3b
(Emulex LPe32000 (LPe32002) rev. 12, <ONLINE>)
Board Name: 111-03249
Serial Number: FC62671433
Firmware rev: 11.1.219.4
Host Port Addr: 010100
FC Nodename: 50:0a:09:80:80:d2:c3:2a (500a098080d2c32a)
FC Portname: 50:0a:09:84:80:d2:c3:2a (500a098480d2c32a)
Connection: PTP, Fabric
Switch Port: stlbrcd6510-26:1
SFP Vendor Name: FINISAR CORP.
SFP Vendor P/N: FTLF8532P4BCV-EM
SFP Vendor Rev: A
SFP Serial No.: UVK1LKB
SFP Connector: LC
SFP Capabilities: 8, 16, 32 Gbit/Sec
slot 4: SAS Host Adapter 4a (PMC-Sierra PM8072 rev. C, SAS, <OFFLINE (hard)>)
MFG Part Number: NetApp, Inc. 110-00401 rev. B0
Part number: 111-02026+B0
Serial number: 031627000853
Date Code: 20160702
44 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
Firmware rev: 03.08.09.00
Base WWN: 5:00a098:0071fe5:40
Phy State: [12] Disabled
[13] Disabled
[14] Disabled
[15] Disabled
QSFP Vendor: not available
QSFP Part Number: not available
QSFP Type: not available
QSFP Serial Number: not available
slot 4: SAS Host Adapter 4b (PMC-Sierra PM8072 rev. C, SAS, <OFFLINE (hard)>)
MFG Part Number: NetApp, Inc. 110-00401 rev. B0
Part number: 111-02026+B0
Serial number: 031627000853
Date Code: 20160702
Firmware rev: 03.08.09.00
Base WWN: 5:00a098:0071fe5:44
Phy State: [8] Disabled
[9] Disabled
[10] Disabled
[11] Disabled
QSFP Vendor: not available
QSFP Part Number: not available
QSFP Type: not available
QSFP Serial Number: not available
slot 4: SAS Host Adapter 4c (PMC-Sierra PM8072 rev. C, SAS, <OFFLINE (hard)>)
MFG Part Number: NetApp, Inc. 110-00401 rev. B0
Part number: 111-02026+B0
Serial number: 031627000853
Date Code: 20160702
Firmware rev: 03.08.09.00
Base WWN: 5:00a098:0071fe5:48
Phy State: [0] Disabled
[1] Disabled
[2] Disabled
[3] Disabled
QSFP Vendor: not available
QSFP Part Number: not available
QSFP Type: not available
QSFP Serial Number: not available
slot 4: SAS Host Adapter 4d (PMC-Sierra PM8072 rev. C, SAS, <OFFLINE (hard)>)
MFG Part Number: NetApp, Inc. 110-00401 rev. B0
Part number: 111-02026+B0
Serial number: 031627000853
Date Code: 20160702
Firmware rev: 03.08.09.00
Base WWN: 5:00a098:0071fe5:4c
Phy State: [4] Disabled
[5] Disabled
[6] Disabled
[7] Disabled
QSFP Vendor: not available
QSFP Part Number: not available
QSFP Type: not available
QSFP Serial Number: not available
slot 5: 40 Gigabit Ethernet Controller XL710 QSFP+
e5a MAC Address: 3c:fd:fe:a2:49:b0 (auto-10g_twinax-fd-up)
QSFP Vendor: CISCO
QSFP Part Number: L45593-D178-B50
QSFP Serial Number: LCC1732G2MG
e5b MAC Address: 3c:fd:fe:a2:49:b1 (auto-10g_twinax-fd-up)
QSFP Vendor: CISCO
QSFP Part Number: L45593-D178-B50
QSFP Serial Number: LCC1732G2MG
e5c MAC Address: 3c:fd:fe:a2:49:b2 (auto-10g_twinax-fd-up)
QSFP Vendor: CISCO
QSFP Part Number: L45593-D178-B50
QSFP Serial Number: LCC1732G2MG
e5d MAC Address: 3c:fd:fe:a2:49:b3 (auto-10g_twinax-fd-up)
QSFP Vendor: CISCO
QSFP Part Number: L45593-D178-B50
45 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
QSFP Serial Number: LCC1732G2MG
Device Type: XL710 4, PBA J27441-002
Firmware Version: fw 5.0 nvm 5.04 etid 800028f2
Serial Number: 3CFDFEA249B0
Output for sysconfig -a Command for Storage Node 02
The following is the output for the sysconfig -a command for node 02:
stlaurora-7and8::> node run -node stlaurora-7and8-02 sysconfig -a
NetApp Release 9.2: Mon Jun 19 20:23:37 PDT 2017
System ID: 0537051915 (stlaurora-7and8-02); partner ID: 0537051946 (stlaurora-7and8-01)
System Serial Number: 23380268F00G (stlaurora-7and8-02)
System Rev: 10
System Storage Configuration: Quad-Path HA
System ACP Connectivity: Inband Active
All-Flash Optimized: true
Backplane Part Number: 1A42CRB00+10
Backplane Serial Number: 2CRB0267M00D
slot 0: System Board 2.3 GHz (System Board XXIII 10)
Model Name: AFF-A700s
Part Number: TEMP-S000092338
Revision: 10
Serial Number: 2BJJ0267S03F
BIOS version: 12.0
Loader version: 6.1
Processors: 36
Processor ID: 0x406f1
Microcode Version: 0xb00001d
Processor type: Intel(R) Xeon(R) CPU E5-2697 v4 @ 2.30GHz
Memory Size: 524288 MB
Memory Attributes: Node Interleaving
Hoisting
Rank Interleaving
Channel Interleaving
Chipkill ECC
Controller: B
Service Processor Status: Online
Firmware Version: 1.12
Mgmt MAC Address: 00:a0:98:ad:ad:2f
Ethernet Link: up
Using DHCP: yes
IPv4 configuration:
IP Address: 10.63.158.145
Netmask: 255.255.255.0
Gateway: 10.63.158.1
IPv6 configuration:
Global IP: ::
Prefix Length: 0
Gateway: ::
Router Assigned IP: 0.0.0.0
Link Local IP: 0.0.0.0
slot 0: Gigabit Ethernet I210
e0M MAC Address: 00:a0:98:af:90:58 (auto-1000t-fd-up)
Device Type: 1533
Firmware Version: 3.25-3.1 0x800005CD
slot 0: Gigabit Ethernet Controller 82580
e0S MAC Address: 00:a0:98:af:90:59 (auto-1000t-fd-up)
Device Type: 1537
Firmware Version: 3.19 0x800005DB
slot 0: 40 Gigabit Ethernet Controller XL710 QSFP+
e0a MAC Address: 90:e2:ba:cf:18:48 (auto-40g_cr4-fd-up)
QSFP Vendor: CISCO-TYCO
QSFP Part Number: 2821248-3
QSFP Serial Number: TED2033JMG6-B
e0e MAC Address: 90:e2:ba:cf:18:49 (auto-unknown-fd-down)
QSFP Vendor:
QSFP Part Number:
QSFP Serial Number:
e0f MAC Address: 90:e2:ba:cf:16:70 (auto-40g_cr4-fd-up)
46 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
QSFP Vendor: CISCO-TYCO
QSFP Part Number: 2821248-3
QSFP Serial Number: TED2033JMHH-B
e0j MAC Address: 90:e2:ba:cf:16:71 (auto-unknown-fd-down)
QSFP Vendor:
QSFP Part Number:
QSFP Serial Number:
Device Type: XL710 4, PBA H52289-006, PBA H52289-006
Firmware Version: fw 5.0 nvm 5.04 etid 800028f4
slot 0: NVMe Boot Media #1 (0x144d,0xa802)
Boot Media #1 SAMSUNG MZVLV128HCGR-00000 BXV7000Q 119GB 512B/sect
(S2J4NX0H506575)
slot 0: NVMe Boot Media #2 (0x144d,0xa802)
Boot Media #2 SAMSUNG MZVLV128HCGR-00000 BXV7000Q 119GB 512B/sect
(S2J4NX0H506572)
slot 0: SAS Host Adapter 0a (Avago Technologies SAS3008 rev. 2, SAS, <UP>)
Firmware rev: 13.00.00.00
NVDATA rev: 11.02.17.08
Base WWN: 5:1c666d:001007c:38
Phy State: [0] Enabled, 12.0 Gb/s
[1] Enabled, 12.0 Gb/s
[2] Enabled, 12.0 Gb/s
[3] Enabled, 12.0 Gb/s
00.0 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900214)
00.1 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801588)
00.2 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901365)
00.3 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904782)
00.4 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901366)
00.5 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901392)
00.6 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900961)
00.7 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900560)
00.8 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901386)
00.9 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901371)
00.10: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900521)
00.11: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801200)
00.12: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H903553)
00.13: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904781)
00.14: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900248)
00.15: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800957)
00.16: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900816)
00.17: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800413)
00.18: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904776)
00.19: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900265)
00.20: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900759)
00.21: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900864)
00.22: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901382)
00.23: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901388)
Shelf 0: FS424-12 Firmware rev. IOM12F A: 0110 IOM12F B: 0110
slot 0: SAS Host Adapter 0b (Avago Technologies SAS3008 rev. 2, SAS, <UP>)
Firmware rev: 13.00.00.00
NVDATA rev: 11.02.17.08
Base WWN: 5:1c666d:001007c:3c
Phy State: [0] Enabled, 12.0 Gb/s
[1] Enabled, 12.0 Gb/s
[2] Enabled, 12.0 Gb/s
[3] Enabled, 12.0 Gb/s
00.0 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900214)
00.1 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801588)
00.2 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901365)
00.3 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904782)
00.4 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901366)
00.5 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901392)
00.6 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900961)
00.7 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900560)
00.8 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901386)
00.9 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901371)
00.10: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900521)
00.11: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801200)
00.12: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H903553)
00.13: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904781)
00.14: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900248)
47 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
00.15: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800957)
00.16: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900816)
00.17: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800413)
00.18: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904776)
00.19: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900265)
00.20: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900759)
00.21: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900864)
00.22: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901382)
00.23: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901388)
Shelf 0: FS424-12 Firmware rev. IOM12F A: 0110 IOM12F B: 0110
slot 0: SAS Host Adapter 0c (Avago Technologies SAS3008 rev. 2, SAS, <UP>)
Firmware rev: 13.00.00.00
NVDATA rev: 11.02.01.08
Base WWN: 5:1c666d:001007c:30
Phy State: [0] Enabled, 12.0 Gb/s
[1] Enabled, 12.0 Gb/s
[2] Enabled, 12.0 Gb/s
[3] Enabled, 12.0 Gb/s
00.0 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900214)
00.1 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801588)
00.2 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901365)
00.3 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904782)
00.4 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901366)
00.5 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901392)
00.6 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900961)
00.7 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900560)
00.8 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901386)
00.9 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901371)
00.10: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900521)
00.11: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801200)
00.12: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H903553)
00.13: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904781)
00.14: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900248)
00.15: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800957)
00.16: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900816)
00.17: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800413)
00.18: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904776)
00.19: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900265)
00.20: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900759)
00.21: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900864)
00.22: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901382)
00.23: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901388)
Shelf 0: FS424-12 Firmware rev. IOM12F A: 0110 IOM12F B: 0110
slot 0: SAS Host Adapter 0d (Avago Technologies SAS3008 rev. 2, SAS, <UP>)
Firmware rev: 13.00.00.00
NVDATA rev: 11.02.01.08
Base WWN: 5:1c666d:001007c:34
Phy State: [0] Enabled, 12.0 Gb/s
[1] Enabled, 12.0 Gb/s
[2] Enabled, 12.0 Gb/s
[3] Enabled, 12.0 Gb/s
00.0 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900214)
00.1 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801588)
00.2 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901365)
00.3 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904782)
00.4 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901366)
00.5 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901392)
00.6 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900961)
00.7 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900560)
00.8 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901386)
00.9 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901371)
00.10: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900521)
00.11: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801200)
00.12: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H903553)
00.13: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904781)
00.14: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900248)
00.15: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800957)
00.16: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900816)
00.17: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800413)
00.18: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904776)
00.19: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900265)
48 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
00.20: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900759)
00.21: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900864)
00.22: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901382)
00.23: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901388)
Shelf 0: FS424-12 Firmware rev. IOM12F A: 0110 IOM12F B: 0110
slot 0: Intel USB EHCI Adapter u0b (0xc7f00000)
slot 1: NVRAM (NVRAM 10-P)
Revision: 20
Serial Number: 031627001760
DIMM Size: 16384 MB
Memory Size: 16384 MB
Battery Status: Battery sufficiently charged
Running Firmware: 1.1.5
slot 1: Interconnect HBA: Generic OFED Provider
Port Name: ic1a
GID: fe80:0000:0000:0000:0000:0000:0000:0105
Base LID: 0x105
Active MTU: 8192
slot 1: HSL Interconnect
Data Rate: 80 Gb/s (8X)
Link State: ACTIVE
QSFP Vendor: Molex Inc.
QSFP Part Number: 112-00435+A0
QSFP Type: Passive Copper 1m ID:00
QSFP Serial Number: 615630503
QSFP Vendor: Molex Inc.
QSFP Part Number: 112-00435+A0
QSFP Type: Passive Copper 1m ID:00
QSFP Serial Number: 615630404
slot 2: Fibre Channel Target Host Adapter 2a
(Emulex LPe32000 (LPe32002) rev. 12, <ONLINE>)
Board Name: 111-03249
Serial Number: FC62671168
Firmware rev: 11.1.219.4
Host Port Addr: 010200
FC Nodename: 50:0a:09:80:80:12:c3:0b (500a09808012c30b)
FC Portname: 50:0a:09:81:80:12:c3:0b (500a09818012c30b)
Connection: PTP, Fabric
Switch Port: stlbrcd6510-25:2
SFP Vendor Name: FINISAR CORP.
SFP Vendor P/N: FTLF8532P4BCV-EM
SFP Vendor Rev: A
SFP Serial No.: UVK1LH2
SFP Connector: LC
SFP Capabilities: 8, 16, 32 Gbit/Sec
slot 2: Fibre Channel Target Host Adapter 2b
(Emulex LPe32000 (LPe32002) rev. 12, <ONLINE>)
Board Name: 111-03249
Serial Number: FC62671168
Firmware rev: 11.1.219.4
Host Port Addr: 010200
FC Nodename: 50:0a:09:80:80:12:c3:0b (500a09808012c30b)
FC Portname: 50:0a:09:82:80:12:c3:0b (500a09828012c30b)
Connection: PTP, Fabric
Switch Port: stlbrcd6510-26:2
SFP Vendor Name: FINISAR CORP.
SFP Vendor P/N: FTLF8532P4BCV-EM
SFP Vendor Rev: A
SFP Serial No.: UVE0TLZ
SFP Connector: LC
SFP Capabilities: 8, 16, 32 Gbit/Sec
slot 3: Fibre Channel Target Host Adapter 3a
(Emulex LPe32000 (LPe32002) rev. 12, <ONLINE>)
Board Name: 111-03249
Serial Number: FC62671412
Firmware rev: 11.1.219.4
Host Port Addr: 010300
FC Nodename: 50:0a:09:80:80:12:c3:0b (500a09808012c30b)
FC Portname: 50:0a:09:83:80:12:c3:0b (500a09838012c30b)
Connection: PTP, Fabric
Switch Port: stlbrcd6510-25:3
49 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
SFP Vendor Name: FINISAR CORP.
SFP Vendor P/N: FTLF8532P4BCV-EM
SFP Vendor Rev: A
SFP Serial No.: UVK1LRC
SFP Connector: LC
SFP Capabilities: 8, 16, 32 Gbit/Sec
slot 3: Fibre Channel Target Host Adapter 3b
(Emulex LPe32000 (LPe32002) rev. 12, <ONLINE>)
Board Name: 111-03249
Serial Number: FC62671412
Firmware rev: 11.1.219.4
Host Port Addr: 010300
FC Nodename: 50:0a:09:80:80:12:c3:0b (500a09808012c30b)
FC Portname: 50:0a:09:84:80:12:c3:0b (500a09848012c30b)
Connection: PTP, Fabric
Switch Port: stlbrcd6510-26:3
SFP Vendor Name: FINISAR CORP.
SFP Vendor P/N: FTLF8532P4BCV-EM
SFP Vendor Rev: A
SFP Serial No.: UVK1LRJ
SFP Connector: LC
SFP Capabilities: 8, 16, 32 Gbit/Sec
slot 4: SAS Host Adapter 4a (PMC-Sierra PM8072 rev. C, SAS, <OFFLINE (hard)>)
MFG Part Number: NetApp, Inc. 110-00401 rev. B0
Part number: 111-02026+B0
Serial number: 031627002139
Date Code: 20160702
Firmware rev: 03.08.09.00
Base WWN: 5:00a098:007216c:90
Phy State: [12] Disabled
[13] Disabled
[14] Disabled
[15] Disabled
QSFP Vendor: not available
QSFP Part Number: not available
QSFP Type: not available
QSFP Serial Number: not available
slot 4: SAS Host Adapter 4b (PMC-Sierra PM8072 rev. C, SAS, <OFFLINE (hard)>)
MFG Part Number: NetApp, Inc. 110-00401 rev. B0
Part number: 111-02026+B0
Serial number: 031627002139
Date Code: 20160702
Firmware rev: 03.08.09.00
Base WWN: 5:00a098:007216c:94
Phy State: [8] Disabled
[9] Disabled
[10] Disabled
[11] Disabled
QSFP Vendor: not available
QSFP Part Number: not available
QSFP Type: not available
QSFP Serial Number: not available
slot 4: SAS Host Adapter 4c (PMC-Sierra PM8072 rev. C, SAS, <OFFLINE (hard)>)
MFG Part Number: NetApp, Inc. 110-00401 rev. B0
Part number: 111-02026+B0
Serial number: 031627002139
Date Code: 20160702
Firmware rev: 03.08.09.00
Base WWN: 5:00a098:007216c:98
Phy State: [0] Disabled
[1] Disabled
[2] Disabled
[3] Disabled
QSFP Vendor: not available
QSFP Part Number: not available
QSFP Type: not available
QSFP Serial Number: not available
slot 4: SAS Host Adapter 4d (PMC-Sierra PM8072 rev. C, SAS, <OFFLINE (hard)>)
MFG Part Number: NetApp, Inc. 110-00401 rev. B0
Part number: 111-02026+B0
Serial number: 031627002139
50 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
Date Code: 20160702
Firmware rev: 03.08.09.00
Base WWN: 5:00a098:007216c:9c
Phy State: [4] Disabled
[5] Disabled
[6] Disabled
[7] Disabled
QSFP Vendor: not available
QSFP Part Number: not available
QSFP Type: not available
QSFP Serial Number: not available
slot 5: 40 Gigabit Ethernet Controller XL710 QSFP+
e5a MAC Address: 3c:fd:fe:a1:9c:d8 (auto-10g_twinax-fd-up)
QSFP Vendor: CISCO
QSFP Part Number: L45593-D178-B50
QSFP Serial Number: LCC1741G0U7
e5b MAC Address: 3c:fd:fe:a1:9c:d9 (auto-10g_twinax-fd-up)
QSFP Vendor: CISCO
QSFP Part Number: L45593-D178-B50
QSFP Serial Number: LCC1741G0U7
e5c MAC Address: 3c:fd:fe:a1:9c:da (auto-10g_twinax-fd-up)
QSFP Vendor: CISCO
QSFP Part Number: L45593-D178-B50
QSFP Serial Number: LCC1741G0U7
e5d MAC Address: 3c:fd:fe:a1:9c:db (auto-10g_twinax-fd-up)
QSFP Vendor: CISCO
QSFP Part Number: L45593-D178-B50
QSFP Serial Number: LCC1741G0U7
Device Type: XL710 4, PBA J27441-002
Firmware Version: fw 5.0 nvm 5.04 etid 800028f2
Serial Number: 3CFDFEA19CD8
Output for vol show Command The following is the output for the vol show command:
stlaurora-7and8::> vol show
Vserver Volume Aggregate State Type Size Available Used%
--------- ------------ ------------ ---------- ---- ---------- ---------- -----
splunksvm nfs_stlrx2540m1_74_splunk_index_vol1
aggr1 online RW 600GB 534.0GB 10%
splunksvm nfs_stlrx2540m1_75_splunk_index_vol1
aggr1 online RW 600GB 533.6GB 11%
splunksvm nfs_stlrx2540m1_76_splunk_index_vol1
aggr1 online RW 600GB 534.9GB 10%
splunksvm nfs_stlrx2540m1_77_splunk_index_vol1
aggr1 online RW 600GB 534.0GB 11%
splunksvm nfs_stlrx2540m1_78_splunk_index_vol1
aggr2 online RW 600GB 540.0GB 10%
splunksvm nfs_stlrx2540m1_79_splunk_index_vol1
aggr2 online RW 600GB 540.0GB 10%
splunksvm nfs_stlrx2540m1_80_splunk_index_vol1
aggr2 online RW 600GB 540.0GB 10%
splunksvm nfs_stlrx2540m1_81_splunk_index_vol1
aggr2 online RW 600GB 540.0GB 10%
splunksvm splunksvm_root
aggr1 online RW 1GB 971.5MB 5%
splunksvm stlrx2540m1_74_splunk_index_vol1
aggr1 online RW 600GB 64.56GB 89%
splunksvm stlrx2540m1_74_splunk_index_vol1_clone_07112017_152639_99
aggr1 online RW 600GB 76.65GB 87%
Vserver Volume Aggregate State Type Size Available Used%
--------- ------------ ------------ ---------- ---- ---------- ---------- -----
splunksvm stlrx2540m1_75_splunk_index_vol2
aggr1 online RW 600GB 62.77GB 89%
splunksvm stlrx2540m1_75_splunk_index_vol2_clone_07112017_153925_14
aggr1 online RW 600GB 70.71GB 88%
splunksvm stlrx2540m1_76_splunk_index_vol3
aggr1 online RW 600GB 60.08GB 89%
51 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
splunksvm stlrx2540m1_76_splunk_index_vol3_clone_07112017_153944_56
aggr1 online RW 600GB 71.27GB 88%
splunksvm stlrx2540m1_77_splunk_index_vol4
aggr1 online RW 600GB 64.69GB 89%
splunksvm stlrx2540m1_77_splunk_index_vol4_clone_07112017_154003_90
aggr1 online RW 600GB 71.89GB 88%
splunksvm stlrx2540m1_78_splunk_index_vol5
aggr2 online RW 600GB 61.52GB 89%
splunksvm stlrx2540m1_79_splunk_index_vol6
aggr2 online RW 600GB 59.39GB 90%
splunksvm stlrx2540m1_80_splunk_index_vol7
aggr2 online RW 600GB 60.78GB 89%
splunksvm stlrx2540m1_81_splunk_index_vol8
aggr2 online RW 600GB 64.40GB 89%
Vserver Volume Aggregate State Type Size Available Used%
--------- ------------ ------------ ---------- ---- ---------- ---------- -----
splunksvm stlrx2540m1_82_splunk_frd_vol1
aggr1 online RW 600GB 271.5GB 54%
splunksvm stlrx2540m1_83_splunk_frd_vol2
aggr2 online RW 600GB 315.8GB 47%
splunksvm stlrx2540m1_84_splunk_frd_vol3
aggr2 online RW 600GB 198.2GB 66%
splunksvm stlrx2540m1_85_splunk_cntl_mon_vol1
aggr1 online RW 600GB 47.94GB 92%
splunksvm stlrx2540m1_86_splunk_search_head_vol1
aggr2 online RW 600GB 47.94GB 92%
stlaurora-7and8-01
vol0 aggr0 online RW 939.3GB 776.6GB 17%
stlaurora-7and8-02
vol0 aggr0_stlaurora_7and8_02_0
Appendix B: Test Configuration Details
The following two Splunk configurations are referenced in this document:
• Splunk with NetApp AFF A700 FC SAN for indexer storage
• Splunk with DAS internal to the servers
This appendix gives server details for both configurations.
Servers Used with AFF A700 FC SAN Configuration
The following servers were used with the AFF A700 FC SAN configuration:
• Fujitsu Primergy RX2540 M1 servers, each equipped with:
2 CPUs, 16 physical cores total
Intel Xeon CPU E5-2670 v3 @ 2.30GHz
256GB physical memory
2 x 300GB SAS OS drives (mirrored)
1 QLogic QLE2672 QLogic 2-port 16Gb FC Adapter
Note: Figure 2 is a graphical representation of this configuration.
Servers Used with Internal DAS Configuration
The following servers were used with the internal DAS configuration:
• Dell R730xd PowerEdge servers each equipped with:
2 CPUs, 16 physical cores total
52 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
Intel Xeon CPU E5-2670 v3 @ 2.30GHz
128GB physical memory
4 x 800GB SSD, RAID 10
12 x 1.2TB SAS RAID 10
2 x 600GB SAS OS drives (mirrored)
Note: Figure 9 is a graphical representation of this configuration.
Figure 9) DAS configuration.
Acknowledgements
• Karthik Nagalingam, Senior Architect (Big Data Analytics & Databases), NetApp
• Keith Griffin, Lab Support Engineer, NetApp
• Laura Finkelstein, Director of Product Management, NetApp
• Scott Lane, Senior Manager, Workload Engineering and Performance Measurement, NetApp
• Mitch Blackburn, Technical Marketing Engineer, NetApp
• Paul Burland, Sales Representative, NetApp
• Nilesh Bagad, Senior Product Manager, NetApp
• Krister Eriksson, Senior Product Manager, NetApp
• Mike McNamara, Senior Manager, Product Marketing, NetApp
• Jim Farney, Senior Product Manager, NetApp
• Austin Albrecht, Consulting Engineer, Global Technology Resources, Inc. (GTRI)
Where to Find Additional Information
To learn more about the information presented in this document, refer to the following documents and
websites:
• Global Technical Resources, Inc. (GTRI)
http://www.gtri.com/
53 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
• NetApp All Flash Arrays product page https://www.netapp.com/us/products/storage-systems/all-flash-array/aff-a-series.aspx
• NetApp ONTAP Data Management Software product page
http://www.netapp.com/us/products/data-management-software/ontap.aspx
• Splunk https://www.splunk.com/
• Splunk App for NetApp Data ONTAP
https://splunkbase.splunk.com/app/1293/
• TR-4623: NetApp E-Series E5700 and Splunk Enterprise http://www.netapp.com/us/media/tr-4623.pdf
Version History
Version Date Document Version History
Version 1.0 December 2017 Initial release.
54 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.
Refer to the Interoperability Matrix Tool (IMT) on the NetApp Support site to validate that the exact product and feature versions described in this document are supported for your specific environment. The NetApp IMT defines the product components and versions that can be used to construct configurations that are supported by NetApp. Specific results depend on each customer’s installation in accordance with
published specifications.
Copyright Information
Copyright © 2017 NetApp, Inc. All rights reserved. Printed in the U.S. No part of this document covered by copyright may be reproduced in any form or by any means—graphic, electronic, or mechanical, including photocopying, recording, taping, or storage in an electronic retrieval system—without prior written permission of the copyright owner.
Software derived from copyrighted NetApp material is subject to the following license and disc laimer:
THIS SOFTWARE IS PROVIDED BY NETAPP “AS IS” AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL NETAPP BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
NetApp reserves the right to change any products described herein at any time, and without notice.
NetApp assumes no responsibility or liability arising from the use of products described herein, except as expressly agreed to in writing by NetApp. The use or purchase of this product does not convey a license under any patent rights, trademark rights, or any other intellectual property rights of NetApp.
The product described in this manual may be protected by one or more U.S. patents, foreign patents, or pending applications.
RESTRICTED RIGHTS LEGEND: Use, duplication, or disclosure by the government is subject to
restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS 252.277-7103 (October 1988) and FAR 52-227-19 (June 1987).
Trademark Information
NETAPP, the NETAPP logo, and the marks listed at http://www.netapp.com/TM are trademarks of NetApp, Inc. Other company and product names may be trademarks of their respective owners.
TR-4650-1217