+ All Categories
Home > Documents > TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise...

TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise...

Date post: 08-Jun-2018
Category:
Upload: dinhtu
View: 241 times
Download: 0 times
Share this document with a friend
54
Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric Group/ONTAP Software and Systems Group, NetApp December 2017 | TR-4650 Abstract This document presents performance and reliability data for NetApp ® ONTAP ® in a Splunk Enterprise environment. It also presents test results for verifying healthy Splunk responses to restoring deleted data from snapshots and for recovering from a controller and disk drive failure.
Transcript
Page 1: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

Technical Report

NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment

Data Fabric Group/ONTAP Software and Systems Group, NetApp

December 2017 | TR-4650

Abstract

This document presents performance and reliability data for NetApp® ONTAP® in a Splunk

Enterprise environment. It also presents test results for verifying healthy Splunk responses

to restoring deleted data from snapshots and for recovering from a controller and disk

drive failure.

Page 2: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

2 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

TABLE OF CONTENTS

1 Introduction.................................................................................................................................4

2 Solution Overview .......................................................................................................................5

2.1 Target Audience .....................................................................................................................................................5

2.2 Solution Architecture ..............................................................................................................................................5

2.3 Solution Positioning ...............................................................................................................................................6

3 Test Plan Summary .....................................................................................................................7

4 Test Results Summary ................................................................................................................7

5 Technology Overview..................................................................................................................9

5.1 Splunk .....................................................................................................................................................................9

5.2 NetApp AFF Systems Powered by ONTAP 9 ....................................................................................................10

6 Test Configuration Details......................................................................................................... 12

6.1 Infrastructure ........................................................................................................................................................12

6.2 Indexer Storage Configuration ............................................................................................................................13

7 Test Procedure and Detailed Results ........................................................................................ 14

7.1 Performance Baseline Test: Indexing Rate ........................................................................................................14

7.2 Performance Baseline Test: Query Execution Performance .............................................................................15

7.3 ONTAP Storage Efficiency Test ..........................................................................................................................18

7.4 Backup and Restore Test ....................................................................................................................................19

7.5 Storage System Resilience Test (Controller Failure) .........................................................................................22

7.6 Disk Failure and Reconstruct Test ......................................................................................................................24

7.7 Splunk Indexer Failure Test.................................................................................................................................27

7.8 Creation of Data Copies with FlexClone Technology Test ................................................................................28

8 Conclusion ................................................................................................................................ 31

Appendix A: Storage Configuration ................................................................................................ 32

Output for df -S Command ...........................................................................................................................................32

Output for df -A -S Command.......................................................................................................................................33

Output for lun show Command.....................................................................................................................................33

Output for sysconfig -r Command on Storage Node 01..............................................................................................34

Output for sysconfig -r Command for Storage Node 02 .............................................................................................37

Output for sysconfig -a Command for Storage Node 01.............................................................................................39

Output for sysconfig -a Command for Storage Node 02.............................................................................................45

Output for vol show Command.....................................................................................................................................50

Page 3: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

3 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

Appendix B: Test Configuration Details .......................................................................................... 51

Servers Used with AFF A700 FC SAN Configuration .................................................................................................51

Servers Used with Internal DAS Configuration ...........................................................................................................51

Acknowledgements......................................................................................................................... 52

Where to Find Additional Information ............................................................................................. 52

Version History ............................................................................................................................... 53

LIST OF TABLES

Table 1) ONTAP FC SAN test results summary. .................................................................................................................7

Table 2) Splunk indexing rate performance comparison. ....................................................................................................8

Table 3) Splunk search performance for AFF A700 versus DAS. .......................................................................................8

Table 4) LUN provisioning details. ......................................................................................................................................13

Table 5) Splunk indexing rate performance comparison. ..................................................................................................14

Table 6) Splunk search performance: AFF A700 versus DAS. .........................................................................................15

LIST OF FIGURES

Figure 1) Tested configuration...............................................................................................................................................6

Figure 2) Network topology of tested configuration............................................................................................................12

Figure 3) Indexing rate comparison: A700 versus DAS. ....................................................................................................15

Figure 4) Dense search completion time comparison........................................................................................................16

Figure 5) Very dense search completion time comparison................................................................................................17

Figure 6) Sparse search completion time comparison.......................................................................................................17

Figure 7) Very sparse search completion time comparison...............................................................................................18

Figure 8) Savings from storage efficiency as shown in OnCommand System Manager. ................................................18

Figure 9) DAS configuration. ...............................................................................................................................................52

Page 4: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

4 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

1 Introduction

It’s been estimated that data will grow exponentially well beyond the year 2020. Some studies predict

that by the year 2025, the amount of data in existence will have grown by a factor of 10 times the amount

in 2017. This data comes in many forms, ranging from semistructured to totally unstructured. Sources

include the Internet of Things (IoT), business applications, social media, customer behavior, and machine

sensors, to name just a few.

In this age of digital transformation, machine data is one of the key drivers fueling that growth. Machine

data is generated by technology infrastructures, security systems, and business applications. It's one of

the fastest growing types of data, and it’s also one of the most complex categories of big data. With that

complexity comes high value in the form of information about customer behavior, business and personal

transactions, sensor readings, machine behavior, security threats, and fraudulent activity. Splunk

Enterprise software provides the ability to extract the value from any machine data in real time.

Enterprise organizations depend on big data to help run their businesses, to meet competitive demands

in the market place, and to avoid costly infrastructure downtime. The ability to collect and analyze this

data is key to transportation safety, machine reliability, fraud detection, and security. Enterprise data

protection is an absolute necessity in meeting these demands, which include the following:

• 100% uptime and data availability

• Robust data protection to meet low recovery point objectives (RPOs) and recovery time objectives (RTO)s, with zero loss of data

• Full support for disaster recovery (DR)

• Cost-effective support for DevOps

• Data security

• SEC-compliant backups

• High performance

• Seamless integration with public and private cloud for scale and agility

• Full scalability of data storage

• Storage efficiency to meet cost objectives

This technical report demonstrates that NetApp ONTAP integration with Splunk exceeds these enterprise

requirements for machine data collection and analysis. This document contains the following information:

• The architectural details of a tested Splunk solution integrated with a NetApp All Flash FAS (AFF) storage array

• A test plan for validating the solution and demonstrating NetApp ONTAP enterprise-class data

management and data protection features with Splunk

• Proof points and results from execution of the test plan

• Performance comparison between the AFF configuration and a typical Splunk configuration using commodity servers and internal storage media

NetApp contracted with Global Technology Resources, Inc. (GTRI), in partnership with NetApp Technical Marketing Engineering, to configure the Splunk test environment and execute the test plan. GTRI provides proven IT solutions that address business challenges to drive revenue, reduce costs, and reduce risks for enterprise organizations that are undergoing digital transformation. They also provide professional services, enterprise consulting, and training services, with Splunk being one of their core competencies.

For more information about GTRI, see the GTRI website.

Page 5: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

5 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

2 Solution Overview

Traditionally, Splunk was configured to use commodity servers with internal storage media (disk drives

and solid-state drives [SSDs]). This storage configuration is often referred to as direct-attached storage

(DAS). Splunk best practices recommend configuring those internal disks by using RAID 10, also known

as RAID 1+0. In a RAID 10 configuration, data is striped across pairs of mirrored disk drives to improve

input/output (I/O) performance and to protect against data loss in the event of disk failure. Because of

RAID 10 mirroring, only half of the total raw disk capacity is available. Also, once all the disk drive bays in

the servers are full, more servers must be added to accommodate data growth. This type of configuration

leads to poor storage efficiency and a perpetual imbalance between compute and storage, because

compute and storage cannot be scaled independently.

By storing Splunk data on NetApp AFF powered by ONTAP 9 instead of on internal storage media,

compute and data storage resources are decoupled, allowing enterprises to create efficient configurations

that meet their needs today as well as tomorrow. Servers need to be added only when additional compute

resources are required, and storage can be scaled out independently of compute. Valuable rack space,

floor space, and energy are conserved.

In addition to independent scaling of resources, ONTAP provides the data protection, data governance,

storage efficiency, and copy management features needed to meet the requirements of enterprise

organizations that use Splunk. Those features are discussed later in section 5.2.

2.1 Target Audience

The intended audience of this document includes sales engineers, field consultants, professional

services, IT managers, partner engineering, and customers who want to take advantage of an

infrastructure built to deliver high-performance and enterprise-class features for Splunk deployments. It is

assumed that the reader has a basic understanding of Splunk, NetApp storage, the Linux operating

system, and basic network topologies.

2.2 Solution Architecture

The Splunk solution discussed in this document was built by using the following components, as

illustrated in Figure 1:

• Splunk version 6.6.3:

8 indexer servers

3 universal forwarders

1 cluster master

1 search head

Splunk search factor: 2

Splunk replication factor: 3

• Red Hat Enterprise Linux Server release 7.2: all servers

• NetApp AFF A700 Storage Array (high-availability [HA] pair):

ONTAP 9.2

24 x 960GB SSDs

1 x 550GB FC LUN per indexer

FC protocol

4 dual-port 32Gbps FC adapters

• 13 Fujitsu Primergy RX2540 M1 servers each equipped with:

2 CPUs, 16 physical cores total

Page 6: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

6 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

Intel Xeon CPU E5-2670 v3 @ 2.30GHz

256GB physical memory

2 x 300GB SAS OS drives (mirrored)

16Gbps FC, dual controller

10GbE dual port

Figure 1) Tested configuration.

Details of the DAS configuration used for comparison in this document are provided in Appendix B, with a

graphical representation in Figure 9.

2.3 Solution Positioning

The solution described in this document is not the only NetApp solution for Splunk. There is also a

solution based on the NetApp E5700 storage array, which is documented in TR-4623: NetApp E-Series

E5700 and Splunk Enterprise. The E-Series solution provides excellent performance and flexibility at a

very competitive cost. The AFF A700 solution described here was designed for environments where

enterprise-class data management features are required. Those features include fast backup and restore

capabilities with storage-efficient ONTAP Snapshot™ technology, storage efficiency with deduplication

and compression, Data Fabric enablement, and DevOps support with NetApp FlexClone® volumes.

Implementation of these features with Splunk is discussed later in this document.

Page 7: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

7 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

3 Test Plan Summary

A test plan was executed to provide proof points that a NetApp AFF storage system powered by ONTAP

9 is the ideal data protection/data management platform for enterprise-class organizations using Splunk

to capture and analyze machine data. Not all of the enterprise requirements listed in section 1 were

demonstrated in this study. Items that have been omitted are considered more generic to enterprise-class

storage and are discussed in section 5.2.

All tests were executed with Splunk workflows running. Splunk’s Eventgen utility was used for that

purpose. The validation test plan included the following steps:

1. Perform baseline by using Eventgen to load and index 1TB of sample log data.

2. Perform dense and sparse searches and capture the time requirements of each.

3. Capture ONTAP storage efficiency results from NetApp OnCommand® System Manager.

4. Perform backup and restore operations using NetApp Snapshot and SnapRestore® technologies.

5. Perform storage resilience tests:

a. Failure of a storage node by generating a system panic:

Takeover

Giveback

b. Disk failure and reconstruct

6. Capture Splunk indexer failure: four indexers failed, one after the other.

7. Create a cloned Splunk environment by using NetApp FlexClone technology.

4 Test Results Summary

Each test case completed successfully and fully supported ONTAP as the enterprise-class data

management and protection platform for Splunk. Table 1 shows the results.

Table 1) ONTAP FC SAN test results summary.

Test Description Results Summary

Baseline performance Performance exceeded that of a comparable Splunk DAS configuration for 7

out of 10 tests. Same performance for remaining tests.

Storage efficiency Efficiency ratio: 2.04:1 from inline deduplication and compression.

Snapshot copy creation No visible impact on performance.

SnapRestore Successful. After the data restore operation, Splunk search result was the

same as before data loss.

Storage controller panic No observed impact on Splunk performance; search completed successfully.

Disk failure and reconstruct No observed impact on Splunk performance; search completed successfully.

Splunk indexer failure Minimal impact on Splunk performance; minor spikes during failure event.

FlexClone volume creation No observed impact on Splunk performance; clone configuration for Splunk

completed.

Table 2 contains performance results from the average and peak indexing rates observed during the

benchmark phase of the tests. In this test, the metric is megabytes per second (MBps); therefore, higher

numbers are preferable. As the numbers indicate, the average Splunk indexing rate for the AFF A700

configuration was more than twice that of the DAS configuration, with a performance improvement of

Page 8: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

8 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

109% over DAS. As expected, the peak indexing rate of the A700 configuration was considerably higher

than the average rate, meaning that there was variation in the indexing rate during the indexing

performance test, which is not unusual.

Note: Peak indexing performance data for the commodity server DAS configuration was not available.

Table 2) Splunk indexing rate performance comparison.

Data

Ingest Volume

Average Indexing Rate Observed Peak Indexing Rate Observed

AFF A700 Commodity

Servers with DAS

% Faster

A700 Compared to DAS

AFF A700 Commodity

Servers with DAS

% Faster

A700 Compared to DAS

~1000

GB/day 31.114MBps 14.872MBps +109% 43.892MBps N/A N/A

In addition to the indexing rate, search performance tests were also performed. Splunk Eventgen was

used to generate four different types of searches and capture the completion time of each. Table 3 shows

those results, along with corresponding results from the DAS configuration. The metric of interest in this

set of tests is search completion time in seconds (described in detail later in this section); therefore, lower

numbers indicate better performance.

• A dense search scans through machine-generated data and reports on many events. Examples

include searches that return the number of errors on a web server, or all failed login events on a database server. A dense search results in 1 match per 1,000 lines of log data, while a very dense search results in 1 match per 100 lines.

• A sparse search scans through data looking for a single event or an event that occurs infrequently.

This search is referred to as a “needle in a haystack” search. A sparse search returns 1 match out of 1,000,000 lines scanned, while a very sparse search returns 1 match per 10,000,000 lines.

In this test plan, both searches were tested, while data was being indexed (streamed) and while data was

not being indexed (static). Table 3 lists the search results from the AFF A700 environment compared to

the commodity server with DAS configuration. The reported number is number of seconds for each

search to complete. In this test, a lower number is better. The results clearly show that the A700

outperformed DAS by a wide margin for five of the eight searches tested, and provided equivalent

performance to DAS for the remaining tests.

Note: The numbers in the % Faster columns show how much faster the queries ran on the A700 than with the DAS configuration. For example, comparing the A700 completion time for the dense search with streaming to the DAS configuration, the following formula was used:

(19.79 – 8.128) / 8.128 = 1.4348

The query ran 143% faster with the A700 than with DAS.

Table 3) Splunk search performance for AFF A700 versus DAS.

Forwarder to

Indexer Search Performed

Streaming Search Time (Seconds) Static Search Time (Seconds)

AFF A700 Commodity

Servers

with DAS

% Faster A700

Compared to

DAS

AFF A700 Commodity

Servers

with DAS

% Faster A700

Compared to

DAS

Dense 8.128 19.79 143% 8.136 32.7 302%

Very dense 24.147 43.35 80% 20.226 49.15 143%

Sparse 2.065 2.07 0% 2.061 5.02 144%

Very sparse 2.065 2.07 0% 2.061 2.07 0%

Note: Details of the tests and the test results are described in section 7.

Page 9: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

9 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

5 Technology Overview

5.1 Splunk

Machine data is the fastest-growing type of big data. The format is unpredictable, coming from so many

different sources, at such a high rate, and in such great volumes, that it’s often referred to as digital

exhaust. It’s constantly being generated by servers, server infrastructures, applications, sensors,

electronics, buildings, security systems, and all the elements that make up the IoT. Machine data is

tremendously valuable, in that it contains records of customer behavior, transactions, diagnostics from

critical mechanical systems, message queues, change events — and the list goes on. It's difficult to

unlock the value in this data due to its high volume and lack of structure. Splunk Enterprise provides the

platform for collecting, indexing, and analyzing machine data from any source to deliver operational

intelligence, which can be used to optimize IT, security, and business performance. It provides powerful

search, analysis, and visualization capabilities that can be accessed across organizations, and is

available as on-premises software or as a cloud service.

Splunk uses a distributed search framework that scales linearly. Its implementation of MapReduce

enables large-scale search, reporting, and alerting. The Splunk platform is open and has software

development kits (SDKs) and application programming interfaces (APIs), including a REST API and SDKs

for Python, Java, JavaScript, PHP, Ruby, and C#. It also provides node failover and workload balancing

across components.

Splunk Use Cases

Common use cases for Splunk include:

• Analyze system performance: log monitoring and reporting with trend analysis

• Troubleshoot failure condition: root cause analysis using system logs

• Monitor business metrics: analysis of output from business applications and real-time data

• Search and investigate an outcome

• Create dashboards to visualize and analyze results

• Provide security monitoring and assurance

At a time when large-scale data breaches and cyberthreats often make headlines, security is a primary

concern for everyone, from the largest online retailers to anyone who has a bank account. Splunk offers a

very powerful framework for fraud prevention and security. Use cases include:

• Malware detection and investigation:

Detect infected hosts

Determine the spread of malware

• Data exfiltration—unauthorized transfer of data over a network:

Monitor transactions

Isolate suspicious events

• Privileged user monitoring:

Prevent or contain advanced attacks

Prevent or contain insider threat-based attacks

• Identification of patient zero malware:

Identify command-and-control network communications

Identify malware-infected hosts

Identify first infected host (patient zero) of a malware outbreak

• Detect zero-day attacks—exploitation of unknown software security vulnerability:

Page 10: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

10 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

Splunk Enterprise Security Risk Analysis Framework

Security Domain dashboards

• Fraud detection—account takeovers:

Detect and investigate

Remediation actions initiated by Splunk

• Ensure compliance—detect when critical systems stop sending logs to Splunk:

Avoid regulatory compliance issues

Investigation and remediation actions

• User Behavior Analytics (UBA) for insider threats:

Detect and mitigate insider threats

Fully automated and continuous monitoring

• UBA for external threats:

Detect cyberattacks of malware and hidden threats

Stop external threats before it’s too late

Of all the Splunk use cases, security is the most critical for any organization or individual. It’s so critical

that Splunk offers a product that is completely dedicated to security. For Splunk to provide the high level

of security required today, the product must be configured for continuous uptime and optimal

performance. NetApp AFF storage arrays powered by ONTAP provide the features and tools to meet

those requirements.

5.2 NetApp AFF Systems Powered by ONTAP 9

NetApp is the data authority for hybrid cloud, data protection, data availability , and copy management.

NetApp empowers customers to simplify and integrate data management across cloud and on-premises

environments to accelerate digital transformation. Together with its partners, NetApp offers a full range of

hybrid cloud data services to help global organizations unleash the full potential of their data to expand

customer touchpoints, foster greater innovation, and optimize their operations. This section summarizes

key NetApp technologies and features.

NetApp All Flash FAS Storage Arrays

NetApp AFF systems address enterprise storage requirements with high performance, flexibility, and

best-in-class data management. Built on ONTAP software and designed specifically for flash, AFF

systems deliver industry-leading performance, capacity density, scalability, security, and network

connectivity. NetApp AFF storage provides both 40 Gigabit Ethernet (40GbE) and 32Gbps FC

connectivity. AFF systems are Data Fabric ready, with proven cloud connectivity, enabling you to move

workloads where they run best and data where it’s needed.

With NetApp RAID DP® technology, AFF systems provide industry-leading, in-place data protection. Also,

with the NetApp flash-optimized WAFL® system and enhanced built-in quality of service (QoS), consistent

high performance at 1ms latencies and lower is achieved.

AFF systems are scalable and highly available. For more information about the enterprise-grade data

management features of AFF systems, see the NetApp All Flash FAS Datasheet.

The following sections describe some of the key AFF ONTAP features.

NetApp ONTAP Snapshot and SnapRestore Technologies

With ONTAP Snapshot technology, you can create point-in-time data copies with no impact on

performance and with minimal consumption of storage space. You can create these Snapshot copies

Page 11: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

11 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

almost instantaneously and use them with the SnapRestore software to recover entire file systems or data

volumes in seconds.

NetApp FlexClone Volumes

FlexClone volumes are space-efficient, writable data copies that can be created almost instantly,

anywhere in the Data Fabric or hybrid cloud where a Snapshot copy exists. FCP, iSCSI, and NFS are

supported protocols, and they are perfect for DevOps. FlexClone technology makes it possible for

developers, QA engineers, and software testers to work with real production data. FlexClone volumes can

be easily created and deleted, and any changes made to them have zero impact on the parent production

data. They can even be split from the parent production data and promoted to production, if necessary.

FlexClone volumes can be considered as free data copies.

NetApp Storage Efficiency

ONTAP 9 offers inline deduplication, compression, and compaction. Whether written to on-premises or

cloud storage, the data occupies less space, which translates to lower data storage costs.

NetApp SnapMirror

NetApp SnapMirror® works with ONTAP Snapshot copies to transport data seamlessly and efficiently

between NetApp storage systems to support backup, restore, and DR operations. SnapMirror simplifies

data protection management across the Data Fabric with cross-platform replication from flash to disk to

cloud. It provides data replication between ONTAP devices, regardless of the host protocol or ONTAP

version. Supported platforms include NetApp AltaVault™, ONTAP, and ONTAP Cloud. SnapMirror is both

policy-driven and network optimized. Only changed blocks are sent across the network, and network

compression is built in.

NetApp Data Fabric

The technologies described so far in this section are just a few of the components of the NetApp Data

Fabric, which represents NetApp's vision for the future of data management. The Data Fabric architecture

allows users to move workloads freely and easily where they run best and to move data where it’s

needed. It supports on-premises data storage and management as well as storage and management in

the cloud, hybrid cloud, and private cloud ecosystems. With the NetApp Data Fabric, data becomes more

mobile, scalable, and accessible. Users are no longer limited to a single public cloud provider, because

data can now be moved between clouds. Also, data can be managed across multiple environments by

using common tools and processes, regardless of its location.

Splunk App for NetApp Data ONTAP

The Splunk App for NetApp Data ONTAP enables you to visualize the configuration, performance, and

syslog events for all NetApp Data ONTAP® storage arrays in your Splunk deployment. With the Splunk

App for Data ONTAP, you can do the following from a single pane of glass:

• Reduce problem investigation and resolution times.

• Gain real-time insights into key performance metrics, anomalies, and outliers across all your storage

systems and configured subsystems.

• Improve your storage monitoring efficiency and proactively plan storage capacity allocations with more than 30 out-of-the-box, customizable reports.

• Correlate data from all NetApp systems with data from operating systems, applications, networks, and virtual and physical infrastructure for enterprise-wide 360-degree visibility.

• Get central proactive monitoring of Data ONTAP systems, including real-time notification of important Data ONTAP events.

Page 12: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

12 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

For more information, see Splunk App for NetApp Data ONTAP.

6 Test Configuration Details

This section describes our tested configuration: the network infrastructure, Splunk server functionality,

storage provisioning details, and Linux host-side storage configuration.

6.1 Infrastructure

The test results were created with eight Splunk Indexer servers connected to a NetApp AFF A700 storage

array over 16Gb FC. The indexer servers were connected to a Splunk 10GbE network of three

forwarders, controller monitor, and search head RHEL 7.2 servers.

Figure 2) Network topology of tested configuration.

The components in Figure 2 provide the following functions:

• The indexer servers receive and index incoming data, send or receive replicated data in the cluster, and search across indexed data for search requests from the search head.

• The forwarders consume data from external sources and forward it to indexer servers.

• The search head manages searches across the cluster of indexer servers. It distributes the search

queries to the indexer servers and consolidates the results.

Note: All searches are run from the search head. Each cluster must have at least one search head.

Page 13: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

13 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

• The cluster master (controller monitor) manages the Splunk cluster. It coordinates replicating activities of the indexer servers and communicates with the search head for information about where to locate data for searches. It also remediates activities if an indexer server goes offline.

Note: Each cluster has only one controller monitor.

• The machine log data from the Splunk forwarders sent to the indexer peer nodes uses the recommended data replication factor of three, which makes available three copies of data. The ingested data is compressed and indexed as raw data files and metadata, which are then distributed

among the indexer peer nodes for redundancy.

6.2 Indexer Storage Configuration

One FC LUN was assigned to each indexer. LUNs were configured with one LUN per storage volume,

with four volumes in aggregate aggr1 and the other four volumes in aggregate aggr2. Aggr1 was

configured on the first storage controller and aggr2 was configured on the second controller. LUNs were

550GB is size, with the corresponding volumes being 600GB in size. Table 4 lists the provisioning details

for the LUN used by the indexers.

Table 4) LUN provisioning details.

Controller Aggregate Volume LUN Aggregate

Size Volume Size LUN Size

Controller 1

Aggr1 6.91TB

Vol1 LUN1 600GB 550GB

Vol2 LUN2 600GB 550GB

Vol3 LUN3 600GB 550GB

Vol4 LUN4 600GB 550GB

Controller 2

Aggr2 6.91TB

Vol5 LUN5 600GB 550GB

Vol6 LUN6 600GB 550GB

Vol7 LUN7 600GB 550GB

Vol8 LUN8 600GB 550GB

Both aggregates (aggr1 and aggr2) were created with an SSD count of 23.

After storage was provisioned and mapped to the indexers, the following tasks were completed as part of

the test:

1. Created a single logical volume group on each LUN, one volume group per indexer.

2. Created one logical volume on each volume group.

3. Created an XFS file system on each logical volume.

4. Created a mount point for the XFS file system named /splunk on each indexer.

5. Mounted the new file system under the /splunk mount point by using the following options:

Allocsize = 128m

Page 14: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

14 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

noatime

nobarrier

nodiratime

7 Test Procedure and Detailed Results

The AFF A700 Splunk configuration test plan included the following test cases:

1. Performance baseline test: average and peak indexing rate

2. Performance baseline test: query execution time

3. ONTAP storage efficiency test (for 1TB of indexed data)

4. Snapshot copy creation; impact on performance

5. Backup and restore test (using SnapRestore technology); ability to successfully restore data from a

Snapshot copy following catastrophic data loss

6. Storage system resilience test; impact of storage controller panic on running Splunk query

7. Disk failure and reconstruct test; impact on running query

8. Splunk indexer failure test

9. Creation of data copies with FlexClone technology test:

a. Impact on running query

b. Ability to configure indexers to use clones

Note: The following sections describe each test case in detail.

7.1 Performance Baseline Test: Indexing Rate

For this test, the Splunk Eventgen utility was used to generate approximately 1TB of simulated syslog

data. That data was spread evenly across the three forwarders and then streamed to the eight indexers,

where it was indexed and stored on the AFF A700. Both peak and average indexing rates were captured

by using the Splunk Search and Reporting App. Those results are recorded in Table 5 and Figure 3,

along with test results from a similar Splunk configuration using DAS. Notice that for the average indexing

rate, the AFF A700 configuration outperformed the commodity servers with DAS by 109%. In other words,

indexing was more than twice as fast as with DAS. Peak indexing rate for the DAS configuration was not

available.

Table 5) Splunk indexing rate performance comparison.

Data Ingest

Volume Average Indexing Rate Observed Peak Indexing Rate Observed

AFF A700 Commodity

Servers with DAS

% Faster

A700 Compared to DAS

AFF A700 Commodity

Servers with DAS

% Faster

A700 Compared to DAS

~1000GB/day 31.114

MBps

14.872MBps +109% 43.892

MBps

Not Available N/A

Figure 3 is a graphical view of the data in Table 5, emphasizing the indexing performance difference

between the A700 and DAS configurations. As with all of the tests, the Splunk Eventgen utility was used

to generate the workflow I/O.

Page 15: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

15 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

Figure 3) Indexing rate comparison: A700 versus DAS.

7.2 Performance Baseline Test: Query Execution Performance

After the indexing rate test was complete, the query execution tests were performed. The following query

types were run using Eventgen:

• Dense search. A query that scans data and reports multiple events. A dense search returns 1 match per 1,000 lines of log data scanned.

• Very dense search. A very dense search returns 1 match per 100 lines.

• Sparse search. A query that scans through data looking for a single event or an event that occurs

infrequently. A sparse search returns 1 match out of 1,000,000 lines scanned.

• Very sparse search. A very sparse search returns 1 match per 10,000,000 lines scanned.

Note: Examples of a dense search include searches that return the number of errors on a web server, or all failed login events on a database server.

Note: Sparse searches are often referred to as “needle in a haystack” searches.

Each type of search was performed with indexers actively indexing data and with indexers in a static

state. Those results are presented in Table 6, along with results from the same tests performed with a

similarly configured DAS Splunk environment. The key metric of these tests is completion time in

seconds; therefore, lower numbers are better.

Table 6) Splunk search performance: AFF A700 versus DAS.

Forwarder to

Indexer Search Performed

Streaming Search Time (Seconds) Static Search Time (Seconds)

AFF A700 Commodity

Servers with DAS

% Faster A700

Compared to DAS

AFF A700 Commodity

Servers with DAS

% Faster A700

Compared to DAS

Dense 8.128 19.79 143% 8.136 32.7 302%

Very dense 24.147 43.35 80% 20.226 49.15 143%

Sparse 2.065 2.07 0% 2.061 5.02 144%

Very sparse 2.065 2.07 0% 2.061 2.07 0%

Page 16: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

16 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

The results clearly show that the A700 outperformed DAS by a wide margin for five out of eight queries

performed. Performance was about the same as DAS for the remaining tests. The numbers in the %

Faster columns show how much faster the queries ran on the A700 than with the DAS configuration. For

example, comparing the A700 completion time for the dense search with streaming to the DAS

configuration, the following formula was used:

(19.79 – 8.128) / 8.128 = 143%

The query ran 143% faster with the A700 than with DAS.

For the AFF A700 configuration, on average, dense and very dense searches (streaming and static) ran

143% and 302% faster, respectively, then with the DAS configuration:

• Dense searches with concurrent streaming ran 143% faster than with DAS.

• Dense searches without concurrent streaming (static) ran 302% faster than with DAS.

• Very dense searches with concurrent streaming ran 80% faster than with DAS.

• Very dense searches without concurrent streaming (static) ran 143% faster than with DAS.

• For sparse and very sparse searches, the A700 either outperformed DAS or performed at par with DAS:

Sparse and very sparse searches, with and without concurrent streaming, performed about the same as with DAS, as did very sparse searches without concurrent streaming.

Sparse searches without concurrent streaming ran 144% faster than with DAS.

Figures 4 through 7 are graphical representations of these results.

Figure 4) Dense search completion time comparison.

Page 17: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

17 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

Figure 5) Very dense search completion time comparison.

Figure 6) Sparse search completion time comparison.

Page 18: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

18 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

Figure 7) Very sparse search completion time comparison.

7.3 ONTAP Storage Efficiency Test

After the performance benchmark tests, storage efficiency was queried by using OnCommand System

Manager, as shown in Figure 8. Overall storage efficiency for the aggregates used in our Splunk

configuration was reported to be 2.04:1 for about 2TB of actual data. The storage savings is the result of

inline deduplication and compression.

Figure 8) Savings from storage efficiency as shown in OnCommand System Manager.

The size of the dataset was approximately 1.91TB, but the actual physical space used was only about

959.29GB. The space savings is the result of ONTAP inline deduplication and compression. Results can

vary based on actual data, but in this case, the physical size of our data was approximately half the size

of the actual data. A closer look revealed that approximately 25% of the reduction was the result of

deduplication and the remaining was the result of compression.

Page 19: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

19 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

Best practices for Splunk using DAS require storage media to be configured as RAID 10, which involves

mirroring. In that configuration, Splunk has access to only half of a server’s internal storage. With NetApp

AFF storage, Splunk data requires storage space equal to half the size of the actual data. In other words:

1TB of DAS can store .5TB of data, while 1TB of AFF storage can store 2TB of data!

7.4 Backup and Restore Test

The following procedure was performed for the backup and restore test:

1. OnCommand System Manager was used to create Snapshot copy backups of all eight data volumes. Those Snapshot copies were created while a query was being run. Performance was monitored and there was no visible impact.

2. The Splunk data was queried to establish a healthy baseline.

Page 20: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

20 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

3. All Splunk data was deleted to simulate total data loss.

The query failed with an error.

4. To start the restore operation, the following steps were completed:

a. All Splunk processes were stopped.

b. All data file systems on the indexers were unmounted.

c. All eight data volumes used by the indexers were restored from previously created Snapshot

copies by using SnapRestore, as shown in the following screenshots.

Page 21: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

21 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

Page 22: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

22 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

5. The restored file systems were then mounted on the indexers and Splunk was restarted. The same query was executed again and produced identical results as before all data was destroyed. The SnapRestore operation completed in a matter of seconds. The data was restored and fully available in less than 5 minutes following a catastrophic data loss.

7.5 Storage System Resilience Test (Controller Failure)

The following procedure was performed for the storage system resilience test:

1. A Splunk workflow was applied to a healthy system and then a controller failure was induced to observe the response from Splunk.

2. While a workflow was running, a panic was induced on one of the storage controllers.

Page 23: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

23 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

3. From OnCommand System Manager, the impact on the storage system was observed.

At this point, the surviving controller took over for the failed controller and served data from the failed controller's disks.

4. Several minutes later, the affected controller was recovered, a giveback was performed, and it was

observed that both controllers were up and healthy.

Page 24: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

24 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

5. Splunk performance was monitored throughout the test.

The panic was induced 1 minute after the workflow was started. Performance was monitored for 1

minute after giveback was completed. There was no visible impact on Splunk performance during that time, and the workflow completed successfully. Results may vary regarding the performance impact, depending on controller resource utilization.

7.6 Disk Failure and Reconstruct Test

The following procedure was performed for the disk failure and reconstruct test:

1. A disk drive was failed during a Splunk index operation. In this example, disk 1.0.15 in System Manager was chosen for the test.

Page 25: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

25 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

2. Disk 1.0.15 was failed in immediate mode, without allowing any time for the contents to be copied to a replacement disk.

3. The status of disk 1.0.15 was broken.

Page 26: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

26 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

4. After 2 minutes, the disk was manually unfailed.

5. The previously failed disk was recovered as a spare. Reconstruction had already begun on another spare disk.

Page 27: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

27 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

6. Reconstruction completed in approximately 20 minutes as the Splunk workflow continued to run without any noticeable impact.

There was no visible impact on performance as the Splunk workflow completed.

7.7 Splunk Indexer Failure Test

The following procedure was performed for the Splunk indexer failure test:

1. Four out of eight indexers were manually failed, one by one, using the Linux kill command to end

the Splunk processes, while an indexing workflow was in progress. There was zero impact on performance, and the workflow was not interrupted as the indexers failed.

The purpose of this test was not to capture the impact of indexer failure on performance, but to demonstrate that NetApp storage fully supports indexer node failover. The impact on performance

would be determined by CPU and memory utilization on the servers, but not by storage I/O bandwidth utilization. Since storage in this configuration is shared at the controller and aggregate levels, and connectivity between the servers and storage is achieved by using 16Gbps FC, failure of an indexer would have no impact on storage performance. Storage I/O bandwidth utilization remained the same,

Page 28: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

28 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

as did Splunk query performance. Use of NetApp AFF storage fully supports Splunk's indexer failover capability.

7.8 Creation of Data Copies with FlexClone Technology Test

The purpose of the creation of data copies was to demonstrate the use of NetApp FlexClone technology

to create free, instant copies of production data. The following procedure was performed for this test:

1. FlexClone volumes of the data volumes used by four of the indexers were created, as shown in the following screenshot.

2. The LUNs in the FlexClone volumes were mapped to four unused servers.

3. Cloned file systems were mounted to the unused servers.

4. A list of the newly created FlexClone volumes is displayed.

Page 29: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

29 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

The actual physical footprint of the clones ranges from 8.09MB to 48.63MB, while the storage capacity of each clone is 600GB. Relatively speaking, these FlexClone volumes really are free data copies.

A list of the new LUNs along with the volume clones containing them is displayed.

5. After the new LUNs are brought online, they are mapped to initiator groups.

Page 30: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

30 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

Note: Each volume clone contains a single LUN, and each LUN contains a copy of the logical volume and file system from the parent volume.

6. The following procedure was executed on each new indexer server to mount the file systems that exist on the cloned LUNs:

a. Ran the rescan-scsi-bus.sh -a command to make the cloned LUNs visible to the indexer

server.

b. Ran the vgscan command to discover the volume group on the LUN clone.

c. Ran the lvscan command to discover the logical volume on the LUN clone volume group.

d. Created a new mount point for the new file system; for example, executed the mkdir /splunk

command.

e. Added the new file system to the Linux /etc/fstab file on the new indexer server and then

mount the cloned file system by running the mount /splunk command.

7. Ran the Linux find command to confirm that the data existed in the cloned file system.

Page 31: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

31 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

8. The Splunk cluster was configured to use the four new indexer servers. Splunk processes were started, and the cluster was ready for workflow execution.

8 Conclusion

Machine data is one of the fastest growing types of big data. That data, often referred to as digital

exhaust, is generated in real time with sources including IT infrastructures, web servers, online retail and

financial systems, machine sensors, and all the elements that make up the IoT. Machine data is

unstructured, has very high velocity, and is extremely large in volume, making it impossible to capture

and analyze using traditional analytics tools, such as traditional relational databases. Depending on the

source, machine data might contain computer logs, location data, sensor readings, output from medical

devices, records of financial transactions, and records of security-related events, to name just a few.

Splunk provides the tools and capabilities that allow an enterprise organization to collect that data and

extract high value from it, such as patterns of customer behavior, trending data that might predict

equipment failure, and indications of financial fraud. Those tools and capabilities include visualization,

extremely fast data ingest, real-time analytics, a rich set of APIs, notification capabilities, and extreme

scalability.

Enterprise organizations depend on the continuous availability and continuous analysis of data. In the

area of healthcare, where critical medical devices are monitored in real time, seconds can mean the

difference between life and death. In the area of security, real-time analytics can help prevent financial

fraud and attacks on sensitive computer systems. If a security breach has already occurred, or in case of

a cyberattack, analytics can help identify the source and limit the damage. For an enterprise guarding

against security breaches and intrusions, microseconds matter. Traditional Splunk deployments with

direct-attached storage are subject to server sprawl. The Splunk best practice recommendation to

configure server storage with mirroring means that only half of a server’s storage capacity is available for

data. Also, adding storage capacity requires servers to be added, even if additional compute capacity is

not needed. Splunk also relies on traditional methods for data protection and DR, which are slow and

consume valuable storage and compute resources. Backups can’t be created of ten enough to meet low

RPOs, and recovery takes too long to meet RTO requirements.

As demonstrated in this document, in most cases NetApp AFF performance exceeds that of DAS. It has

also been demonstrated that backups can be created almost instantaneously by using NetApp Snapshot

technology, that those backups require very little storage space, and that they can be used to quickly

recover a Splunk system from catastrophic data loss. In addition, it has been shown that Snapshot copy

creation has zero impact on performance and is completely nondisruptive. The resilience of NetApp

storage was also demonstrated: A panic condition was created on one of the storage controllers, with

zero impact on availability and zero impact on performance.

Note: Based on workload, there could be a small impact of short duration on performance, but that was not observed during the tests.

In addition to controller failover testing, a disk failure test was performed, which resulted in zero impact on

performance or on Splunk availability. ONTAP storage efficiency offers another valuable feature: a 2:1

Page 32: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

32 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

savings in storage utilization because of ONTAP inline deduplication and compression, as well as an

additional 2:1 savings without the traditional disk mirroring recommended by Splunk. Finally, the ability to

create instant, free data copies by using FlexClone technology, a key feature for support of DevOps, was

demonstrated.

The proof points and test results described in this document clearly demonstrate that by decoupling

compute from storage and implementing NetApp AFF storage in Splunk deployments, the following

results are achieved:

• Higher performance

• A reduction in server requirements

• A reduction in storage requirements

• A more robust Splunk configuration

• Enterprise-class data protection

• Faster recovery from data loss

• Consistent performance, even in the event of storage hardware failure

These results mean reduced costs for power and data center floor space, and a significant increase in

system reliability and availability. There is no room for compromise on Splunk system reliability and

availability, especially in the areas of healthcare and security. In those environments, Splunk system

downtime, at worst case, can result in loss of life and/or significant financial loss. NetApp AFF storage

powered by ONTAP 9 is the logical choice for Splunk.

Appendix A: Storage Configuration

Output for df -S Command

The following is the output for the df- S command:

stlaurora-7and8::> df -S

Filesystem used total-saved %total-saved deduplicated %deduplicated

compressed %compressed Vserver

/vol/nfs_stlrx2540m1_74_splunk_index_vol1/ 6266288 978212 14% 28628 0%

949584 13% splunksvm

/vol/nfs_stlrx2540m1_75_splunk_index_vol1/ 6664096 917132 12% 34276 0%

882856 12% splunksvm

/vol/nfs_stlrx2540m1_76_splunk_index_vol1/ 5364284 713024 12% 26424 0%

686600 11% splunksvm

/vol/nfs_stlrx2540m1_77_splunk_index_vol1/ 6339364 1036556 14% 28172 0%

1008384 14% splunksvm

/vol/nfs_stlrx2540m1_78_splunk_index_vol1/ 632 16 2% 0 0%

16 2% splunksvm

/vol/nfs_stlrx2540m1_79_splunk_index_vol1/ 540 0 0% 0 0%

0 0% splunksvm

/vol/nfs_stlrx2540m1_80_splunk_index_vol1/ 648 4 1% 0 0%

4 1% splunksvm

/vol/nfs_stlrx2540m1_81_splunk_index_vol1/ 516 0 0% 0 0%

0 0% splunksvm

/vol/splunksvm_root/ 1340 0 0% 0 0%

0 0% splunksvm

/vol/stlrx2540m1_74_splunk_index_vol1/ 561447260 35944712 6% 2243692 0%

33701020 6% splunksvm

/vol/stlrx2540m1_74_splunk_index_vol1_clone_07112017_152639_99/ 548775764 35440456 6% 2272236 0%

33168220 6% splunksvm

/vol/stlrx2540m1_75_splunk_index_vol2/ 563322960 26128084 4% 914360 0%

25213724 4% splunksvm

/vol/stlrx2540m1_75_splunk_index_vol2_clone_07112017_153925_14/ 555004788 26128084 4% 914360 0%

25213724 4% splunksvm

/vol/stlrx2540m1_76_splunk_index_vol3/ 566148880 24716876 4% 1046596 0%

23670280 4% splunksvm

Page 33: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

33 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

/vol/stlrx2540m1_76_splunk_index_vol3_clone_07112017_153944_56/ 554413108 24716876 4% 1046596 0%

23670280 4% splunksvm

/vol/stlrx2540m1_77_splunk_index_vol4/ 561310644 25805200 4% 1209868 0%

24595332 4% splunksvm

/vol/stlrx2540m1_77_splunk_index_vol4_clone_07112017_154003_90/ 553761456 25805200 4% 1209868 0%

24595332 4% splunksvm

/vol/stlrx2540m1_78_splunk_index_vol5/ 564637812 22971176 4% 876596 0%

22094580 4% splunksvm

/vol/stlrx2540m1_79_splunk_index_vol6/ 566874448 24309068 4% 932648 0%

23376420 4% splunksvm

/vol/stlrx2540m1_80_splunk_index_vol7/ 565417500 23032416 4% 1165924 0%

21866492 4% splunksvm

/vol/stlrx2540m1_81_splunk_index_vol8/ 561617444 23099432 4% 1093244 0%

22006188 4% splunksvm

/vol/stlrx2540m1_82_splunk_frd_vol1/ 344507716 261055792 43% 80631120 13%

180424672 30% splunksvm

/vol/stlrx2540m1_83_splunk_frd_vol2/ 298018488 297482956 50% 113276172 19%

184206784 31% splunksvm

/vol/stlrx2540m1_84_splunk_frd_vol3/ 421337732 178440444 30% 54261852 9%

124178592 21% splunksvm

/vol/stlrx2540m1_85_splunk_cntl_mon_vol1/ 578873448 129860 0% 129124 0%

736 0% splunksvm

/vol/stlrx2540m1_86_splunk_search_head_vol1/ 578873468 129768 0% 129124 0%

644 0% splunksvm

/vol/vol0/ 121413276 0 0% 0 0%

0 0% stlaurora-7and8-01

/vol/vol0/ 23125368 0 0% 0 0%

0 0% stlaurora-7and8-02

28 entries were displayed.

Output for df -A -S Command

The following is the output for the df -A -S command:

stlaurora-7and8::> df -A -S

Aggregate used total-saved %total-saved deduplicated %deduplicated

compressed %compressed

aggr0 990430988 0 0% 0 0%

0 0%

aggr0_stlaurora_7and8_02_0 990426232 0 0% 0 0%

0 0%

aggr1 894099384 77076012 8% 77076012 8%

0 0%

aggr2 753548556 164489668 18% 164489668 18%

0 0%

4 entries were displayed.

Output for lun show Command

The following is the output for the lun show command:

stlaurora-7and8::> lun show

Vserver Path State Mapped Type Size

--------- ------------------------------- ------- -------- -------- --------

splunksvm /vol/stlrx2540m1_74_splunk_index_vol1/stlrx2540m1-74_lun1

online unmapped linux 550.0GB

splunksvm /vol/stlrx2540m1_74_splunk_index_vol1_clone_07112017_152639_99/stlrx2540m1-74_lun1

online mapped linux 550.0GB

splunksvm /vol/stlrx2540m1_75_splunk_index_vol2/stlrx2540m1-75_lun1

online mapped linux 550.0GB

splunksvm /vol/stlrx2540m1_75_splunk_index_vol2_clone_07112017_153925_14/stlrx2540m1-75_lun1

online unmapped linux 550.0GB

splunksvm /vol/stlrx2540m1_76_splunk_index_vol3/stlrx2540m1-76_lun1

online mapped linux 550.0GB

splunksvm /vol/stlrx2540m1_76_splunk_index_vol3_clone_07112017_153944_56/stlrx2540m1-76_lun1

online unmapped linux 550.0GB

splunksvm /vol/stlrx2540m1_77_splunk_index_vol4/stlrx2540m1-77_lin1

online mapped linux 550.0GB

Page 34: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

34 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

splunksvm /vol/stlrx2540m1_77_splunk_index_vol4_clone_07112017_154003_90/stlrx2540m1-77_lin1

online unmapped linux 550.0GB

splunksvm /vol/stlrx2540m1_78_splunk_index_vol5/stlrx2540m1_78_lun1

online mapped linux 550.0GB

splunksvm /vol/stlrx2540m1_79_splunk_index_vol6/stlrx2540m1-79_lun1

online mapped linux 550.0GB

splunksvm /vol/stlrx2540m1_80_splunk_index_vol7/stlrx2540m1-80_lun1

online mapped linux 550.0GB

Vserver Path State Mapped Type Size

--------- ------------------------------- ------- -------- -------- --------

splunksvm /vol/stlrx2540m1_81_splunk_index_vol8/stlrx2540m1-81_lun1

online mapped linux 550.0GB

splunksvm /vol/stlrx2540m1_82_splunk_frd_vol1/stlrx2540m1-82_lun1

online mapped linux 550.0GB

splunksvm /vol/stlrx2540m1_83_splunk_frd_vol2/stlrx2540m1-83_lun1

online mapped linux 550.0GB

splunksvm /vol/stlrx2540m1_84_splunk_frd_vol3/stlrx2540m1-84_lun1

online mapped linux 550.0GB

splunksvm /vol/stlrx2540m1_85_splunk_cntl_mon_vol1/stlrx2540m1-85_lun1

online mapped linux 550.0GB

splunksvm /vol/stlrx2540m1_86_splunk_search_head_vol1/stlrx2540m1-86_lun1

online mapped linux 550.0GB

17 entries were displayed.

Output for sysconfig -r Command on Storage Node 01

The following is the output for the sysconfig -r command on node 01:

stlaurora-7and8::> node run -node stlaurora-7and8-0

stlaurora-7and8-01 stlaurora-7and8-02

stlaurora-7and8::> node run -node stlaurora-7and8-01 sysconfig -r

Aggregate aggr0 (online, raid_dp) (block checksums)

Plex /aggr0/plex0 (online, normal, active, pool0)

RAID group /aggr0/plex0/rg0 (normal, block checksums)

RAID Disk Device HA SHELF BAY CHAN Pool Type RPM Used (MB/blks) Phys

(MB/blks)

--------- ------ ------------- ---- ---- ---- ----- -------------- ------------

--

dparity 0a.00.0P3 0a 0 0 SA:A 0 SSD N/A 148628/304391168

148636/304407552

parity 0b.00.1P3 0b 0 1 SA:A 0 SSD N/A 148628/304391168

148636/304407552

data 0c.00.2P3 0c 0 2 SA:A 0 SSD N/A 148628/304391168

148636/304407552

data 0d.00.3P3 0d 0 3 SA:A 0 SSD N/A 148628/304391168

148636/304407552

data 0c.00.10P3 0c 0 10 SA:A 0 SSD N/A 148628/304391168

148636/304407552

data 0b.00.5P3 0b 0 5 SA:A 0 SSD N/A 148628/304391168

148636/304407552

data 0c.00.6P3 0c 0 6 SA:A 0 SSD N/A 148628/304391168

148636/304407552

data 0d.00.7P3 0d 0 7 SA:A 0 SSD N/A 148628/304391168

148636/304407552

data 0a.00.8P3 0a 0 8 SA:A 0 SSD N/A 148628/304391168

148636/304407552

data 0b.00.9P3 0b 0 9 SA:A 0 SSD N/A 148628/304391168

148636/304407552

Aggregate aggr1 (online, raid_dp) (block checksums)

Plex /aggr1/plex0 (online, normal, active, pool0)

RAID group /aggr1/plex0/rg0 (normal, block checksums)

RAID Disk Device HA SHELF BAY CHAN Pool Type RPM Used (MB/blks) Phys

(MB/blks)

--------- ------ ------------- ---- ---- ---- ----- -------------- ------------

--

Page 35: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

35 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

dparity 0a.00.0P1 0a 0 0 SA:A 0 SSD N/A 383396/785195008

383404/785211392

parity 0b.00.1P1 0b 0 1 SA:A 0 SSD N/A 383396/785195008

383404/785211392

data 0c.00.2P1 0c 0 2 SA:A 0 SSD N/A 383396/785195008

383404/785211392

data 0d.00.3P1 0d 0 3 SA:A 0 SSD N/A 383396/785195008

383404/785211392

data 0d.00.19P1 0d 0 19 SA:A 0 SSD N/A 383396/785195008

383404/785211392

data 0b.00.5P1 0b 0 5 SA:A 0 SSD N/A 383396/785195008

383404/785211392

data 0c.00.6P1 0c 0 6 SA:A 0 SSD N/A 383396/785195008

383404/785211392

data 0d.00.7P1 0d 0 7 SA:A 0 SSD N/A 383396/785195008

383404/785211392

data 0a.00.8P1 0a 0 8 SA:A 0 SSD N/A 383396/785195008

383404/785211392

data 0b.00.9P1 0b 0 9 SA:A 0 SSD N/A 383396/785195008

383404/785211392

data 0a.00.12P1 0a 0 12 SA:A 0 SSD N/A 383396/785195008

383404/785211392

data 0b.00.13P1 0b 0 13 SA:A 0 SSD N/A 383396/785195008

383404/785211392

data 0c.00.14P1 0c 0 14 SA:A 0 SSD N/A 383396/785195008

383404/785211392

data 0a.00.4P1 0a 0 4 SA:A 0 SSD N/A 383396/785195008

383404/785211392

data 0a.00.16P1 0a 0 16 SA:A 0 SSD N/A 383396/785195008

383404/785211392

data 0b.00.17P1 0b 0 17 SA:A 0 SSD N/A 383396/785195008

383404/785211392

data 0c.00.18P1 0c 0 18 SA:A 0 SSD N/A 383396/785195008

383404/785211392

data 0d.00.23P1 0d 0 23 SA:A 0 SSD N/A 383396/785195008

383404/785211392

data 0a.00.20P1 0a 0 20 SA:A 0 SSD N/A 383396/785195008

383404/785211392

data 0b.00.21P1 0b 0 21 SA:A 0 SSD N/A 383396/785195008

383404/785211392

data 0c.00.10P1 0c 0 10 SA:A 0 SSD N/A 383396/785195008

383404/785211392

data 0d.00.11P1 0d 0 11 SA:A 0 SSD N/A 383396/785195008

383404/785211392

data 0c.00.22P1 0c 0 22 SA:A 0 SSD N/A 383396/785195008

383404/785211392

Pool1 spare disks (empty)

Pool0 spare disks

RAID Disk Device HA SHELF BAY CHAN Pool Type RPM Used (MB/blks) Phys

(MB/blks)

--------- ------ ------------- ---- ---- ---- ----- -------------- ------------

--

Spare disks for block checksum

spare 0a.00.4P3 0a 0 4 SA:A 0 SSD N/A 148628/304391168

148636/304407552 (not zeroed)

spare 0d.00.11P3 0d 0 11 SA:A 0 SSD N/A 148628/304391168

148636/304407552

spare 0d.00.15P1 0d 0 15 SA:A 0 SSD N/A 383396/785195008

383404/785211392 (not zeroed)

Partner disks

RAID Disk Device HA SHELF BAY CHAN Pool Type RPM Used (MB/blks) Phys

(MB/blks)

--------- ------ ------------- ---- ---- ---- ----- -------------- ------------

--

Page 36: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

36 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

partner 0d.00.15P3 0d 0 15 SA:A 0 SSD N/A 0/0

148636/304407552

partner 0d.00.15P2 0d 0 15 SA:A 0 SSD N/A 0/0

383404/785211392

partner 0a.00.20P3 0a 0 20 SA:A 0 SSD N/A 0/0

148636/304407552

partner 0d.00.3P2 0d 0 3 SA:A 0 SSD N/A 0/0

383404/785211392

partner 0d.00.19P3 0d 0 19 SA:A 0 SSD N/A 0/0

148636/304407552

partner 0d.00.7P2 0d 0 7 SA:A 0 SSD N/A 0/0

383404/785211392

partner 0c.00.14P3 0c 0 14 SA:A 0 SSD N/A 0/0

148636/304407552

partner 0c.00.22P3 0c 0 22 SA:A 0 SSD N/A 0/0

148636/304407552

partner 0d.00.23P3 0d 0 23 SA:A 0 SSD N/A 0/0

148636/304407552

partner 0b.00.21P3 0b 0 21 SA:A 0 SSD N/A 0/0

148636/304407552

partner 0b.00.21P2 0b 0 21 SA:A 0 SSD N/A 0/0

383404/785211392

partner 0a.00.16P3 0a 0 16 SA:A 0 SSD N/A 0/0

148636/304407552

partner 0a.00.16P2 0a 0 16 SA:A 0 SSD N/A 0/0

383404/785211392

partner 0b.00.1P2 0b 0 1 SA:A 0 SSD N/A 0/0

383404/785211392

partner 0b.00.9P2 0b 0 9 SA:A 0 SSD N/A 0/0

383404/785211392

partner 0a.00.20P2 0a 0 20 SA:A 0 SSD N/A 0/0

383404/785211392

partner 0b.00.17P2 0b 0 17 SA:A 0 SSD N/A 0/0

383404/785211392

partner 0b.00.17P3 0b 0 17 SA:A 0 SSD N/A 0/0

148636/304407552

partner 0c.00.22P2 0c 0 22 SA:A 0 SSD N/A 0/0

383404/785211392

partner 0d.00.23P2 0d 0 23 SA:A 0 SSD N/A 0/0

383404/785211392

partner 0c.00.10P2 0c 0 10 SA:A 0 SSD N/A 0/0

383404/785211392

partner 0c.00.14P2 0c 0 14 SA:A 0 SSD N/A 0/0

383404/785211392

partner 0a.00.0P2 0a 0 0 SA:A 0 SSD N/A 0/0

383404/785211392

partner 0b.00.13P3 0b 0 13 SA:A 0 SSD N/A 0/0

148636/304407552

partner 0b.00.13P2 0b 0 13 SA:A 0 SSD N/A 0/0

383404/785211392

partner 0b.00.5P2 0b 0 5 SA:A 0 SSD N/A 0/0

383404/785211392

partner 0a.00.8P2 0a 0 8 SA:A 0 SSD N/A 0/0

383404/785211392

partner 0c.00.18P3 0c 0 18 SA:A 0 SSD N/A 0/0

148636/304407552

partner 0c.00.18P2 0c 0 18 SA:A 0 SSD N/A 0/0

383404/785211392

partner 0c.00.2P2 0c 0 2 SA:A 0 SSD N/A 0/0

383404/785211392

partner 0d.00.19P2 0d 0 19 SA:A 0 SSD N/A 0/0

383404/785211392

partner 0a.00.12P3 0a 0 12 SA:A 0 SSD N/A 0/0

148636/304407552

partner 0a.00.12P2 0a 0 12 SA:A 0 SSD N/A 0/0

383404/785211392

partner 0c.00.6P2 0c 0 6 SA:A 0 SSD N/A 0/0

383404/785211392

partner 0d.00.11P2 0d 0 11 SA:A 0 SSD N/A 0/0

383404/785211392

Page 37: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

37 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

partner 0a.00.4P2 0a 0 4 SA:A 0 SSD N/A 0/0

383404/785211392

Output for sysconfig -r Command for Storage Node 02

The following is the output for the sysconfig -r command for node 02:

stlaurora-7and8::> node run -node stlaurora-7and8-02 sysconfig -r

Aggregate aggr2 (online, raid_dp) (block checksums)

Plex /aggr2/plex0 (online, normal, active, pool0)

RAID group /aggr2/plex0/rg0 (normal, block checksums)

RAID Disk Device HA SHELF BAY CHAN Pool Type RPM Used (MB/blks) Phys

(MB/blks)

--------- ------ ------------- ---- ---- ---- ----- -------------- ------------

--

dparity 0a.00.12P2 0a 0 12 SA:B 0 SSD N/A 383396/785195008

383404/785211392

parity 0b.00.13P2 0b 0 13 SA:B 0 SSD N/A 383396/785195008

383404/785211392

data 0c.00.14P2 0c 0 14 SA:B 0 SSD N/A 383396/785195008

383404/785211392

data 0a.00.4P2 0a 0 4 SA:B 0 SSD N/A 383396/785195008

383404/785211392

data 0a.00.16P2 0a 0 16 SA:B 0 SSD N/A 383396/785195008

383404/785211392

data 0b.00.17P2 0b 0 17 SA:B 0 SSD N/A 383396/785195008

383404/785211392

data 0c.00.18P2 0c 0 18 SA:B 0 SSD N/A 383396/785195008

383404/785211392

data 0d.00.23P2 0d 0 23 SA:B 0 SSD N/A 383396/785195008

383404/785211392

data 0a.00.20P2 0a 0 20 SA:B 0 SSD N/A 383396/785195008

383404/785211392

data 0b.00.21P2 0b 0 21 SA:B 0 SSD N/A 383396/785195008

383404/785211392

data 0a.00.0P2 0a 0 0 SA:B 0 SSD N/A 383396/785195008

383404/785211392

data 0b.00.1P2 0b 0 1 SA:B 0 SSD N/A 383396/785195008

383404/785211392

data 0c.00.2P2 0c 0 2 SA:B 0 SSD N/A 383396/785195008

383404/785211392

data 0d.00.3P2 0d 0 3 SA:B 0 SSD N/A 383396/785195008

383404/785211392

data 0d.00.19P2 0d 0 19 SA:B 0 SSD N/A 383396/785195008

383404/785211392

data 0b.00.5P2 0b 0 5 SA:B 0 SSD N/A 383396/785195008

383404/785211392

data 0c.00.6P2 0c 0 6 SA:B 0 SSD N/A 383396/785195008

383404/785211392

data 0d.00.7P2 0d 0 7 SA:B 0 SSD N/A 383396/785195008

383404/785211392

data 0a.00.8P2 0a 0 8 SA:B 0 SSD N/A 383396/785195008

383404/785211392

data 0b.00.9P2 0b 0 9 SA:B 0 SSD N/A 383396/785195008

383404/785211392

data 0c.00.10P2 0c 0 10 SA:B 0 SSD N/A 383396/785195008

383404/785211392

data 0d.00.11P2 0d 0 11 SA:B 0 SSD N/A 383396/785195008

383404/785211392

data 0c.00.22P2 0c 0 22 SA:B 0 SSD N/A 383396/785195008

383404/785211392

Aggregate aggr0_stlaurora_7and8_02_0 (online, raid_dp) (block checksums)

Plex /aggr0_stlaurora_7and8_02_0/plex0 (online, normal, active, pool0)

RAID group /aggr0_stlaurora_7and8_02_0/plex0/rg0 (normal, block checksums)

RAID Disk Device HA SHELF BAY CHAN Pool Type RPM Used (MB/blks) Phys

(MB/blks)

Page 38: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

38 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

--------- ------ ------------- ---- ---- ---- ----- -------------- ------------

--

dparity 0a.00.12P3 0a 0 12 SA:B 0 SSD N/A 148628/304391168

148636/304407552

parity 0b.00.13P3 0b 0 13 SA:B 0 SSD N/A 148628/304391168

148636/304407552

data 0c.00.14P3 0c 0 14 SA:B 0 SSD N/A 148628/304391168

148636/304407552

data 0d.00.23P3 0d 0 23 SA:B 0 SSD N/A 148628/304391168

148636/304407552

data 0a.00.16P3 0a 0 16 SA:B 0 SSD N/A 148628/304391168

148636/304407552

data 0b.00.17P3 0b 0 17 SA:B 0 SSD N/A 148628/304391168

148636/304407552

data 0c.00.18P3 0c 0 18 SA:B 0 SSD N/A 148628/304391168

148636/304407552

data 0c.00.22P3 0c 0 22 SA:B 0 SSD N/A 148628/304391168

148636/304407552

data 0a.00.20P3 0a 0 20 SA:B 0 SSD N/A 148628/304391168

148636/304407552

data 0b.00.21P3 0b 0 21 SA:B 0 SSD N/A 148628/304391168

148636/304407552

Pool1 spare disks (empty)

Pool0 spare disks

RAID Disk Device HA SHELF BAY CHAN Pool Type RPM Used (MB/blks) Phys

(MB/blks)

--------- ------ ------------- ---- ---- ---- ----- -------------- ------------

--

Spare disks for block checksum

spare 0d.00.15P3 0d 0 15 SA:B 0 SSD N/A 148628/304391168

148636/304407552 (not zeroed)

spare 0d.00.19P3 0d 0 19 SA:B 0 SSD N/A 148628/304391168

148636/304407552 (not zeroed)

spare 0d.00.15P2 0d 0 15 SA:B 0 SSD N/A 383396/785195008

383404/785211392 (not zeroed)

Partner disks

RAID Disk Device HA SHELF BAY CHAN Pool Type RPM Used (MB/blks) Phys

(MB/blks)

--------- ------ ------------- ---- ---- ---- ----- -------------- ------------

--

partner 0c.00.22P1 0c 0 22 SA:B 0 SSD N/A 383396/785195008

383404/785211392

partner 0d.00.11P1 0d 0 11 SA:B 0 SSD N/A 383396/785195008

383404/785211392

partner 0c.00.10P1 0c 0 10 SA:B 0 SSD N/A 383396/785195008

383404/785211392

partner 0b.00.21P1 0b 0 21 SA:B 0 SSD N/A 383396/785195008

383404/785211392

partner 0a.00.20P1 0a 0 20 SA:B 0 SSD N/A 383396/785195008

383404/785211392

partner 0d.00.23P1 0d 0 23 SA:B 0 SSD N/A 383396/785195008

383404/785211392

partner 0c.00.18P1 0c 0 18 SA:B 0 SSD N/A 383396/785195008

383404/785211392

partner 0b.00.17P1 0b 0 17 SA:B 0 SSD N/A 383396/785195008

383404/785211392

partner 0a.00.16P1 0a 0 16 SA:B 0 SSD N/A 383396/785195008

383404/785211392

partner 0d.00.15P1 0d 0 15 SA:B 0 SSD N/A 383396/785195008

383404/785211392

partner 0c.00.14P1 0c 0 14 SA:B 0 SSD N/A 383396/785195008

383404/785211392

partner 0b.00.13P1 0b 0 13 SA:B 0 SSD N/A 383396/785195008

383404/785211392

Page 39: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

39 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

partner 0a.00.12P1 0a 0 12 SA:B 0 SSD N/A 383396/785195008

383404/785211392

partner 0b.00.9P1 0b 0 9 SA:B 0 SSD N/A 383396/785195008

383404/785211392

partner 0a.00.8P1 0a 0 8 SA:B 0 SSD N/A 383396/785195008

383404/785211392

partner 0d.00.7P1 0d 0 7 SA:B 0 SSD N/A 383396/785195008

383404/785211392

partner 0c.00.6P1 0c 0 6 SA:B 0 SSD N/A 383396/785195008

383404/785211392

partner 0b.00.5P1 0b 0 5 SA:B 0 SSD N/A 383396/785195008

383404/785211392

partner 0d.00.19P1 0d 0 19 SA:B 0 SSD N/A 383396/785195008

383404/785211392

partner 0d.00.3P1 0d 0 3 SA:B 0 SSD N/A 383396/785195008

383404/785211392

partner 0c.00.2P1 0c 0 2 SA:B 0 SSD N/A 383396/785195008

383404/785211392

partner 0b.00.1P1 0b 0 1 SA:B 0 SSD N/A 383396/785195008

383404/785211392

partner 0a.00.0P1 0a 0 0 SA:B 0 SSD N/A 383396/785195008

383404/785211392

partner 0a.00.4P1 0a 0 4 SA:B 0 SSD N/A 0/0

383404/785211392

partner 0d.00.11P3 0d 0 11 SA:B 0 SSD N/A 0/0

148636/304407552

partner 0b.00.1P3 0b 0 1 SA:B 0 SSD N/A 0/0

148636/304407552

partner 0b.00.5P3 0b 0 5 SA:B 0 SSD N/A 0/0

148636/304407552

partner 0b.00.9P3 0b 0 9 SA:B 0 SSD N/A 0/0

148636/304407552

partner 0a.00.8P3 0a 0 8 SA:B 0 SSD N/A 0/0

148636/304407552

partner 0a.00.4P3 0a 0 4 SA:B 0 SSD N/A 0/0

148636/304407552

partner 0a.00.0P3 0a 0 0 SA:B 0 SSD N/A 0/0

148636/304407552

partner 0d.00.3P3 0d 0 3 SA:B 0 SSD N/A 0/0

148636/304407552

partner 0c.00.2P3 0c 0 2 SA:B 0 SSD N/A 0/0

148636/304407552

partner 0c.00.10P3 0c 0 10 SA:B 0 SSD N/A 0/0

148636/304407552

partner 0d.00.7P3 0d 0 7 SA:B 0 SSD N/A 0/0

148636/304407552

partner 0c.00.6P3 0c 0 6 SA:B 0 SSD N/A 0/0

148636/304407552

Output for sysconfig -a Command for Storage Node 01

The following is the output for the sysconfig -a command for node 01:

stlaurora-7and8::> node run -node stlaurora-7and8-01 sysconfig -a

NetApp Release 9.2: Mon Jun 19 20:23:37 PDT 2017

System ID: 0537051946 (stlaurora-7and8-01); partner ID: 0537051915 (stlaurora-7and8-02)

System Serial Number: 23380268F01C (stlaurora-7and8-01)

System Rev: 10

System Storage Configuration: Quad-Path HA

System ACP Connectivity: Inband Active

All-Flash Optimized: true

Backplane Part Number: 1A42CRB00+10

Backplane Serial Number: 2CRB0267M00D

slot 0: System Board 2.3 GHz (System Board XXIII 10)

Model Name: AFF-A700s

Part Number: TEMP-S000092338

Revision: 10

Serial Number: 2BJJ0267S043

BIOS version: 12.0

Loader version: 6.1

Page 40: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

40 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

Processors: 36

Processor ID: 0x406f1

Microcode Version: 0xb00001d

Processor type: Intel(R) Xeon(R) CPU E5-2697 v4 @ 2.30GHz

Memory Size: 524288 MB

Memory Attributes: Node Interleaving

Hoisting

Rank Interleaving

Channel Interleaving

Chipkill ECC

Controller: A

Service Processor Status: Online

Firmware Version: 1.12

Mgmt MAC Address: 00:a0:98:ad:ad:2a

Ethernet Link: up

Using DHCP: yes

IPv4 configuration:

IP Address: 10.63.158.146

Netmask: 255.255.255.0

Gateway: 10.63.158.1

IPv6 configuration:

Global IP: ::

Prefix Length: 0

Gateway: ::

Router Assigned IP: 0.0.0.0

Link Local IP: 0.0.0.0

slot 0: Gigabit Ethernet I210

e0M MAC Address: 00:a0:98:af:90:53 (auto-1000t-fd-up)

Device Type: 1533

Firmware Version: 3.25-3.1 0x800005CD

slot 0: Gigabit Ethernet Controller 82580

e0S MAC Address: 00:a0:98:af:90:54 (auto-1000t-fd-up)

Device Type: 1537

Firmware Version: 3.19 0x800005DB

slot 0: 40 Gigabit Ethernet Controller XL710 QSFP+

e0a MAC Address: 90:e2:ba:cf:17:88 (auto-40g_cr4-fd-up)

QSFP Vendor: CISCO-TYCO

QSFP Part Number: 2821248-3

QSFP Serial Number: TED2033JMG6-A

e0e MAC Address: 90:e2:ba:cf:17:89 (auto-unknown-fd-down)

QSFP Vendor:

QSFP Part Number:

QSFP Serial Number:

e0f MAC Address: 90:e2:ba:cf:14:e8 (auto-40g_cr4-fd-up)

QSFP Vendor: CISCO-TYCO

QSFP Part Number: 2821248-3

QSFP Serial Number: TED2033JMHH-A

e0j MAC Address: 90:e2:ba:cf:14:e9 (auto-unknown-fd-down)

QSFP Vendor:

QSFP Part Number:

QSFP Serial Number:

Device Type: XL710 4, PBA H52289-006, PBA H52289-006

Firmware Version: fw 5.0 nvm 5.04 etid 800028f4

slot 0: NVMe Boot Media #1 (0x144d,0xa802)

Boot Media #1 SAMSUNG MZVLV128HCGR-00000 BXV7000Q 119GB 512B/sect

(S2J4NX0H507801)

slot 0: NVMe Boot Media #2 (0x144d,0xa802)

Boot Media #2 SAMSUNG MZVLV128HCGR-00000 BXV7000Q 119GB 512B/sect

(S2J4NX0H507804)

slot 0: SAS Host Adapter 0a (Avago Technologies SAS3008 rev. 2, SAS, <UP>)

Firmware rev: 13.00.00.00

NVDATA rev: 11.02.17.08

Base WWN: 5:1c666d:0010094:f8

Phy State: [0] Enabled, 12.0 Gb/s

[1] Enabled, 12.0 Gb/s

[2] Enabled, 12.0 Gb/s

[3] Enabled, 12.0 Gb/s

00.0 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900214)

00.1 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801588)

00.2 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901365)

00.3 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904782)

Page 41: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

41 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

00.4 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901366)

00.5 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901392)

00.6 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900961)

00.7 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900560)

00.8 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901386)

00.9 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901371)

00.10: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900521)

00.11: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801200)

00.12: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H903553)

00.13: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904781)

00.14: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900248)

00.15: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800957)

00.16: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900816)

00.17: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800413)

00.18: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904776)

00.19: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900265)

00.20: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900759)

00.21: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900864)

00.22: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901382)

00.23: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901388)

Shelf 0: FS424-12 Firmware rev. IOM12F A: 0110 IOM12F B: 0110

slot 0: SAS Host Adapter 0b (Avago Technologies SAS3008 rev. 2, SAS, <UP>)

Firmware rev: 13.00.00.00

NVDATA rev: 11.02.17.08

Base WWN: 5:1c666d:0010094:fc

Phy State: [0] Enabled, 12.0 Gb/s

[1] Enabled, 12.0 Gb/s

[2] Enabled, 12.0 Gb/s

[3] Enabled, 12.0 Gb/s

00.0 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900214)

00.1 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801588)

00.2 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901365)

00.3 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904782)

00.4 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901366)

00.5 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901392)

00.6 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900961)

00.7 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900560)

00.8 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901386)

00.9 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901371)

00.10: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900521)

00.11: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801200)

00.12: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H903553)

00.13: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904781)

00.14: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900248)

00.15: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800957)

00.16: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900816)

00.17: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800413)

00.18: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904776)

00.19: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900265)

00.20: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900759)

00.21: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900864)

00.22: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901382)

00.23: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901388)

Shelf 0: FS424-12 Firmware rev. IOM12F A: 0110 IOM12F B: 0110

slot 0: SAS Host Adapter 0c (Avago Technologies SAS3008 rev. 2, SAS, <UP>)

Firmware rev: 13.00.00.00

NVDATA rev: 11.02.01.08

Base WWN: 5:1c666d:0010094:f0

Phy State: [0] Enabled, 12.0 Gb/s

[1] Enabled, 12.0 Gb/s

[2] Enabled, 12.0 Gb/s

[3] Enabled, 12.0 Gb/s

00.0 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900214)

00.1 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801588)

00.2 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901365)

00.3 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904782)

00.4 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901366)

00.5 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901392)

00.6 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900961)

00.7 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900560)

00.8 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901386)

Page 42: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

42 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

00.9 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901371)

00.10: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900521)

00.11: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801200)

00.12: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H903553)

00.13: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904781)

00.14: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900248)

00.15: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800957)

00.16: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900816)

00.17: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800413)

00.18: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904776)

00.19: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900265)

00.20: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900759)

00.21: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900864)

00.22: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901382)

00.23: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901388)

Shelf 0: FS424-12 Firmware rev. IOM12F A: 0110 IOM12F B: 0110

slot 0: SAS Host Adapter 0d (Avago Technologies SAS3008 rev. 2, SAS, <UP>)

Firmware rev: 13.00.00.00

NVDATA rev: 11.02.01.08

Base WWN: 5:1c666d:0010094:f4

Phy State: [0] Enabled, 12.0 Gb/s

[1] Enabled, 12.0 Gb/s

[2] Enabled, 12.0 Gb/s

[3] Enabled, 12.0 Gb/s

00.0 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900214)

00.1 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801588)

00.2 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901365)

00.3 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904782)

00.4 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901366)

00.5 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901392)

00.6 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900961)

00.7 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900560)

00.8 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901386)

00.9 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901371)

00.10: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900521)

00.11: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801200)

00.12: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H903553)

00.13: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904781)

00.14: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900248)

00.15: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800957)

00.16: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900816)

00.17: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800413)

00.18: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904776)

00.19: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900265)

00.20: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900759)

00.21: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900864)

00.22: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901382)

00.23: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901388)

Shelf 0: FS424-12 Firmware rev. IOM12F A: 0110 IOM12F B: 0110

slot 0: Intel USB EHCI Adapter u0b (0xc7f00000)

slot 1: NVRAM (NVRAM 10-P)

Revision: 20

Serial Number: 031627002032

DIMM Size: 16384 MB

Memory Size: 16384 MB

Battery Status: Battery sufficiently charged

Running Firmware: 1.1.5

slot 1: Interconnect HBA: Generic OFED Provider

Port Name: ic1a

GID: fe80:0000:0000:0000:0000:0000:0000:0104

Base LID: 0x104

Active MTU: 8192

slot 1: HSL Interconnect

Data Rate: 80 Gb/s (8X)

Link State: ACTIVE

QSFP Vendor: Molex Inc.

QSFP Part Number: 112-00435+A0

QSFP Type: Passive Copper 1m ID:00

QSFP Serial Number: 615630503

QSFP Vendor: Molex Inc.

QSFP Part Number: 112-00435+A0

Page 43: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

43 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

QSFP Type: Passive Copper 1m ID:00

QSFP Serial Number: 615630404

slot 2: Fibre Channel Target Host Adapter 2a

(Emulex LPe32000 (LPe32002) rev. 12, <ONLINE>)

Board Name: 111-03249

Serial Number: FC62671468

Firmware rev: 11.1.219.4

Host Port Addr: 010000

FC Nodename: 50:0a:09:80:80:d2:c3:2a (500a098080d2c32a)

FC Portname: 50:0a:09:81:80:d2:c3:2a (500a098180d2c32a)

Connection: PTP, Fabric

Switch Port: stlbrcd6510-25:0

SFP Vendor Name: FINISAR CORP.

SFP Vendor P/N: FTLF8532P4BCV-EM

SFP Vendor Rev: A

SFP Serial No.: UVK1P6P

SFP Connector: LC

SFP Capabilities: 8, 16, 32 Gbit/Sec

slot 2: Fibre Channel Target Host Adapter 2b

(Emulex LPe32000 (LPe32002) rev. 12, <ONLINE>)

Board Name: 111-03249

Serial Number: FC62671468

Firmware rev: 11.1.219.4

Host Port Addr: 010000

FC Nodename: 50:0a:09:80:80:d2:c3:2a (500a098080d2c32a)

FC Portname: 50:0a:09:82:80:d2:c3:2a (500a098280d2c32a)

Connection: PTP, Fabric

Switch Port: stlbrcd6510-26:0

SFP Vendor Name: FINISAR CORP.

SFP Vendor P/N: FTLF8532P4BCV-EM

SFP Vendor Rev: A

SFP Serial No.: UVK1P6Q

SFP Connector: LC

SFP Capabilities: 8, 16, 32 Gbit/Sec

slot 3: Fibre Channel Target Host Adapter 3a

(Emulex LPe32000 (LPe32002) rev. 12, <ONLINE>)

Board Name: 111-03249

Serial Number: FC62671433

Firmware rev: 11.1.219.4

Host Port Addr: 010100

FC Nodename: 50:0a:09:80:80:d2:c3:2a (500a098080d2c32a)

FC Portname: 50:0a:09:83:80:d2:c3:2a (500a098380d2c32a)

Connection: PTP, Fabric

Switch Port: stlbrcd6510-25:1

SFP Vendor Name: FINISAR CORP.

SFP Vendor P/N: FTLF8532P4BCV-EM

SFP Vendor Rev: A

SFP Serial No.: UVK1LPK

SFP Connector: LC

SFP Capabilities: 8, 16, 32 Gbit/Sec

slot 3: Fibre Channel Target Host Adapter 3b

(Emulex LPe32000 (LPe32002) rev. 12, <ONLINE>)

Board Name: 111-03249

Serial Number: FC62671433

Firmware rev: 11.1.219.4

Host Port Addr: 010100

FC Nodename: 50:0a:09:80:80:d2:c3:2a (500a098080d2c32a)

FC Portname: 50:0a:09:84:80:d2:c3:2a (500a098480d2c32a)

Connection: PTP, Fabric

Switch Port: stlbrcd6510-26:1

SFP Vendor Name: FINISAR CORP.

SFP Vendor P/N: FTLF8532P4BCV-EM

SFP Vendor Rev: A

SFP Serial No.: UVK1LKB

SFP Connector: LC

SFP Capabilities: 8, 16, 32 Gbit/Sec

slot 4: SAS Host Adapter 4a (PMC-Sierra PM8072 rev. C, SAS, <OFFLINE (hard)>)

MFG Part Number: NetApp, Inc. 110-00401 rev. B0

Part number: 111-02026+B0

Serial number: 031627000853

Date Code: 20160702

Page 44: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

44 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

Firmware rev: 03.08.09.00

Base WWN: 5:00a098:0071fe5:40

Phy State: [12] Disabled

[13] Disabled

[14] Disabled

[15] Disabled

QSFP Vendor: not available

QSFP Part Number: not available

QSFP Type: not available

QSFP Serial Number: not available

slot 4: SAS Host Adapter 4b (PMC-Sierra PM8072 rev. C, SAS, <OFFLINE (hard)>)

MFG Part Number: NetApp, Inc. 110-00401 rev. B0

Part number: 111-02026+B0

Serial number: 031627000853

Date Code: 20160702

Firmware rev: 03.08.09.00

Base WWN: 5:00a098:0071fe5:44

Phy State: [8] Disabled

[9] Disabled

[10] Disabled

[11] Disabled

QSFP Vendor: not available

QSFP Part Number: not available

QSFP Type: not available

QSFP Serial Number: not available

slot 4: SAS Host Adapter 4c (PMC-Sierra PM8072 rev. C, SAS, <OFFLINE (hard)>)

MFG Part Number: NetApp, Inc. 110-00401 rev. B0

Part number: 111-02026+B0

Serial number: 031627000853

Date Code: 20160702

Firmware rev: 03.08.09.00

Base WWN: 5:00a098:0071fe5:48

Phy State: [0] Disabled

[1] Disabled

[2] Disabled

[3] Disabled

QSFP Vendor: not available

QSFP Part Number: not available

QSFP Type: not available

QSFP Serial Number: not available

slot 4: SAS Host Adapter 4d (PMC-Sierra PM8072 rev. C, SAS, <OFFLINE (hard)>)

MFG Part Number: NetApp, Inc. 110-00401 rev. B0

Part number: 111-02026+B0

Serial number: 031627000853

Date Code: 20160702

Firmware rev: 03.08.09.00

Base WWN: 5:00a098:0071fe5:4c

Phy State: [4] Disabled

[5] Disabled

[6] Disabled

[7] Disabled

QSFP Vendor: not available

QSFP Part Number: not available

QSFP Type: not available

QSFP Serial Number: not available

slot 5: 40 Gigabit Ethernet Controller XL710 QSFP+

e5a MAC Address: 3c:fd:fe:a2:49:b0 (auto-10g_twinax-fd-up)

QSFP Vendor: CISCO

QSFP Part Number: L45593-D178-B50

QSFP Serial Number: LCC1732G2MG

e5b MAC Address: 3c:fd:fe:a2:49:b1 (auto-10g_twinax-fd-up)

QSFP Vendor: CISCO

QSFP Part Number: L45593-D178-B50

QSFP Serial Number: LCC1732G2MG

e5c MAC Address: 3c:fd:fe:a2:49:b2 (auto-10g_twinax-fd-up)

QSFP Vendor: CISCO

QSFP Part Number: L45593-D178-B50

QSFP Serial Number: LCC1732G2MG

e5d MAC Address: 3c:fd:fe:a2:49:b3 (auto-10g_twinax-fd-up)

QSFP Vendor: CISCO

QSFP Part Number: L45593-D178-B50

Page 45: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

45 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

QSFP Serial Number: LCC1732G2MG

Device Type: XL710 4, PBA J27441-002

Firmware Version: fw 5.0 nvm 5.04 etid 800028f2

Serial Number: 3CFDFEA249B0

Output for sysconfig -a Command for Storage Node 02

The following is the output for the sysconfig -a command for node 02:

stlaurora-7and8::> node run -node stlaurora-7and8-02 sysconfig -a

NetApp Release 9.2: Mon Jun 19 20:23:37 PDT 2017

System ID: 0537051915 (stlaurora-7and8-02); partner ID: 0537051946 (stlaurora-7and8-01)

System Serial Number: 23380268F00G (stlaurora-7and8-02)

System Rev: 10

System Storage Configuration: Quad-Path HA

System ACP Connectivity: Inband Active

All-Flash Optimized: true

Backplane Part Number: 1A42CRB00+10

Backplane Serial Number: 2CRB0267M00D

slot 0: System Board 2.3 GHz (System Board XXIII 10)

Model Name: AFF-A700s

Part Number: TEMP-S000092338

Revision: 10

Serial Number: 2BJJ0267S03F

BIOS version: 12.0

Loader version: 6.1

Processors: 36

Processor ID: 0x406f1

Microcode Version: 0xb00001d

Processor type: Intel(R) Xeon(R) CPU E5-2697 v4 @ 2.30GHz

Memory Size: 524288 MB

Memory Attributes: Node Interleaving

Hoisting

Rank Interleaving

Channel Interleaving

Chipkill ECC

Controller: B

Service Processor Status: Online

Firmware Version: 1.12

Mgmt MAC Address: 00:a0:98:ad:ad:2f

Ethernet Link: up

Using DHCP: yes

IPv4 configuration:

IP Address: 10.63.158.145

Netmask: 255.255.255.0

Gateway: 10.63.158.1

IPv6 configuration:

Global IP: ::

Prefix Length: 0

Gateway: ::

Router Assigned IP: 0.0.0.0

Link Local IP: 0.0.0.0

slot 0: Gigabit Ethernet I210

e0M MAC Address: 00:a0:98:af:90:58 (auto-1000t-fd-up)

Device Type: 1533

Firmware Version: 3.25-3.1 0x800005CD

slot 0: Gigabit Ethernet Controller 82580

e0S MAC Address: 00:a0:98:af:90:59 (auto-1000t-fd-up)

Device Type: 1537

Firmware Version: 3.19 0x800005DB

slot 0: 40 Gigabit Ethernet Controller XL710 QSFP+

e0a MAC Address: 90:e2:ba:cf:18:48 (auto-40g_cr4-fd-up)

QSFP Vendor: CISCO-TYCO

QSFP Part Number: 2821248-3

QSFP Serial Number: TED2033JMG6-B

e0e MAC Address: 90:e2:ba:cf:18:49 (auto-unknown-fd-down)

QSFP Vendor:

QSFP Part Number:

QSFP Serial Number:

e0f MAC Address: 90:e2:ba:cf:16:70 (auto-40g_cr4-fd-up)

Page 46: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

46 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

QSFP Vendor: CISCO-TYCO

QSFP Part Number: 2821248-3

QSFP Serial Number: TED2033JMHH-B

e0j MAC Address: 90:e2:ba:cf:16:71 (auto-unknown-fd-down)

QSFP Vendor:

QSFP Part Number:

QSFP Serial Number:

Device Type: XL710 4, PBA H52289-006, PBA H52289-006

Firmware Version: fw 5.0 nvm 5.04 etid 800028f4

slot 0: NVMe Boot Media #1 (0x144d,0xa802)

Boot Media #1 SAMSUNG MZVLV128HCGR-00000 BXV7000Q 119GB 512B/sect

(S2J4NX0H506575)

slot 0: NVMe Boot Media #2 (0x144d,0xa802)

Boot Media #2 SAMSUNG MZVLV128HCGR-00000 BXV7000Q 119GB 512B/sect

(S2J4NX0H506572)

slot 0: SAS Host Adapter 0a (Avago Technologies SAS3008 rev. 2, SAS, <UP>)

Firmware rev: 13.00.00.00

NVDATA rev: 11.02.17.08

Base WWN: 5:1c666d:001007c:38

Phy State: [0] Enabled, 12.0 Gb/s

[1] Enabled, 12.0 Gb/s

[2] Enabled, 12.0 Gb/s

[3] Enabled, 12.0 Gb/s

00.0 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900214)

00.1 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801588)

00.2 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901365)

00.3 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904782)

00.4 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901366)

00.5 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901392)

00.6 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900961)

00.7 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900560)

00.8 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901386)

00.9 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901371)

00.10: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900521)

00.11: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801200)

00.12: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H903553)

00.13: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904781)

00.14: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900248)

00.15: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800957)

00.16: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900816)

00.17: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800413)

00.18: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904776)

00.19: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900265)

00.20: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900759)

00.21: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900864)

00.22: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901382)

00.23: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901388)

Shelf 0: FS424-12 Firmware rev. IOM12F A: 0110 IOM12F B: 0110

slot 0: SAS Host Adapter 0b (Avago Technologies SAS3008 rev. 2, SAS, <UP>)

Firmware rev: 13.00.00.00

NVDATA rev: 11.02.17.08

Base WWN: 5:1c666d:001007c:3c

Phy State: [0] Enabled, 12.0 Gb/s

[1] Enabled, 12.0 Gb/s

[2] Enabled, 12.0 Gb/s

[3] Enabled, 12.0 Gb/s

00.0 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900214)

00.1 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801588)

00.2 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901365)

00.3 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904782)

00.4 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901366)

00.5 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901392)

00.6 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900961)

00.7 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900560)

00.8 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901386)

00.9 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901371)

00.10: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900521)

00.11: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801200)

00.12: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H903553)

00.13: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904781)

00.14: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900248)

Page 47: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

47 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

00.15: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800957)

00.16: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900816)

00.17: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800413)

00.18: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904776)

00.19: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900265)

00.20: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900759)

00.21: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900864)

00.22: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901382)

00.23: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901388)

Shelf 0: FS424-12 Firmware rev. IOM12F A: 0110 IOM12F B: 0110

slot 0: SAS Host Adapter 0c (Avago Technologies SAS3008 rev. 2, SAS, <UP>)

Firmware rev: 13.00.00.00

NVDATA rev: 11.02.01.08

Base WWN: 5:1c666d:001007c:30

Phy State: [0] Enabled, 12.0 Gb/s

[1] Enabled, 12.0 Gb/s

[2] Enabled, 12.0 Gb/s

[3] Enabled, 12.0 Gb/s

00.0 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900214)

00.1 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801588)

00.2 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901365)

00.3 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904782)

00.4 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901366)

00.5 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901392)

00.6 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900961)

00.7 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900560)

00.8 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901386)

00.9 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901371)

00.10: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900521)

00.11: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801200)

00.12: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H903553)

00.13: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904781)

00.14: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900248)

00.15: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800957)

00.16: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900816)

00.17: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800413)

00.18: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904776)

00.19: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900265)

00.20: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900759)

00.21: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900864)

00.22: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901382)

00.23: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901388)

Shelf 0: FS424-12 Firmware rev. IOM12F A: 0110 IOM12F B: 0110

slot 0: SAS Host Adapter 0d (Avago Technologies SAS3008 rev. 2, SAS, <UP>)

Firmware rev: 13.00.00.00

NVDATA rev: 11.02.01.08

Base WWN: 5:1c666d:001007c:34

Phy State: [0] Enabled, 12.0 Gb/s

[1] Enabled, 12.0 Gb/s

[2] Enabled, 12.0 Gb/s

[3] Enabled, 12.0 Gb/s

00.0 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900214)

00.1 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801588)

00.2 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901365)

00.3 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904782)

00.4 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901366)

00.5 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901392)

00.6 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900961)

00.7 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900560)

00.8 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901386)

00.9 : NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901371)

00.10: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900521)

00.11: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H801200)

00.12: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H903553)

00.13: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904781)

00.14: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900248)

00.15: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800957)

00.16: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900816)

00.17: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H800413)

00.18: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H904776)

00.19: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900265)

Page 48: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

48 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

00.20: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900759)

00.21: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H900864)

00.22: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901382)

00.23: NETAPP X371_S163A960ATE NA51 915.4GB 520B/sect (S396NA0H901388)

Shelf 0: FS424-12 Firmware rev. IOM12F A: 0110 IOM12F B: 0110

slot 0: Intel USB EHCI Adapter u0b (0xc7f00000)

slot 1: NVRAM (NVRAM 10-P)

Revision: 20

Serial Number: 031627001760

DIMM Size: 16384 MB

Memory Size: 16384 MB

Battery Status: Battery sufficiently charged

Running Firmware: 1.1.5

slot 1: Interconnect HBA: Generic OFED Provider

Port Name: ic1a

GID: fe80:0000:0000:0000:0000:0000:0000:0105

Base LID: 0x105

Active MTU: 8192

slot 1: HSL Interconnect

Data Rate: 80 Gb/s (8X)

Link State: ACTIVE

QSFP Vendor: Molex Inc.

QSFP Part Number: 112-00435+A0

QSFP Type: Passive Copper 1m ID:00

QSFP Serial Number: 615630503

QSFP Vendor: Molex Inc.

QSFP Part Number: 112-00435+A0

QSFP Type: Passive Copper 1m ID:00

QSFP Serial Number: 615630404

slot 2: Fibre Channel Target Host Adapter 2a

(Emulex LPe32000 (LPe32002) rev. 12, <ONLINE>)

Board Name: 111-03249

Serial Number: FC62671168

Firmware rev: 11.1.219.4

Host Port Addr: 010200

FC Nodename: 50:0a:09:80:80:12:c3:0b (500a09808012c30b)

FC Portname: 50:0a:09:81:80:12:c3:0b (500a09818012c30b)

Connection: PTP, Fabric

Switch Port: stlbrcd6510-25:2

SFP Vendor Name: FINISAR CORP.

SFP Vendor P/N: FTLF8532P4BCV-EM

SFP Vendor Rev: A

SFP Serial No.: UVK1LH2

SFP Connector: LC

SFP Capabilities: 8, 16, 32 Gbit/Sec

slot 2: Fibre Channel Target Host Adapter 2b

(Emulex LPe32000 (LPe32002) rev. 12, <ONLINE>)

Board Name: 111-03249

Serial Number: FC62671168

Firmware rev: 11.1.219.4

Host Port Addr: 010200

FC Nodename: 50:0a:09:80:80:12:c3:0b (500a09808012c30b)

FC Portname: 50:0a:09:82:80:12:c3:0b (500a09828012c30b)

Connection: PTP, Fabric

Switch Port: stlbrcd6510-26:2

SFP Vendor Name: FINISAR CORP.

SFP Vendor P/N: FTLF8532P4BCV-EM

SFP Vendor Rev: A

SFP Serial No.: UVE0TLZ

SFP Connector: LC

SFP Capabilities: 8, 16, 32 Gbit/Sec

slot 3: Fibre Channel Target Host Adapter 3a

(Emulex LPe32000 (LPe32002) rev. 12, <ONLINE>)

Board Name: 111-03249

Serial Number: FC62671412

Firmware rev: 11.1.219.4

Host Port Addr: 010300

FC Nodename: 50:0a:09:80:80:12:c3:0b (500a09808012c30b)

FC Portname: 50:0a:09:83:80:12:c3:0b (500a09838012c30b)

Connection: PTP, Fabric

Switch Port: stlbrcd6510-25:3

Page 49: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

49 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

SFP Vendor Name: FINISAR CORP.

SFP Vendor P/N: FTLF8532P4BCV-EM

SFP Vendor Rev: A

SFP Serial No.: UVK1LRC

SFP Connector: LC

SFP Capabilities: 8, 16, 32 Gbit/Sec

slot 3: Fibre Channel Target Host Adapter 3b

(Emulex LPe32000 (LPe32002) rev. 12, <ONLINE>)

Board Name: 111-03249

Serial Number: FC62671412

Firmware rev: 11.1.219.4

Host Port Addr: 010300

FC Nodename: 50:0a:09:80:80:12:c3:0b (500a09808012c30b)

FC Portname: 50:0a:09:84:80:12:c3:0b (500a09848012c30b)

Connection: PTP, Fabric

Switch Port: stlbrcd6510-26:3

SFP Vendor Name: FINISAR CORP.

SFP Vendor P/N: FTLF8532P4BCV-EM

SFP Vendor Rev: A

SFP Serial No.: UVK1LRJ

SFP Connector: LC

SFP Capabilities: 8, 16, 32 Gbit/Sec

slot 4: SAS Host Adapter 4a (PMC-Sierra PM8072 rev. C, SAS, <OFFLINE (hard)>)

MFG Part Number: NetApp, Inc. 110-00401 rev. B0

Part number: 111-02026+B0

Serial number: 031627002139

Date Code: 20160702

Firmware rev: 03.08.09.00

Base WWN: 5:00a098:007216c:90

Phy State: [12] Disabled

[13] Disabled

[14] Disabled

[15] Disabled

QSFP Vendor: not available

QSFP Part Number: not available

QSFP Type: not available

QSFP Serial Number: not available

slot 4: SAS Host Adapter 4b (PMC-Sierra PM8072 rev. C, SAS, <OFFLINE (hard)>)

MFG Part Number: NetApp, Inc. 110-00401 rev. B0

Part number: 111-02026+B0

Serial number: 031627002139

Date Code: 20160702

Firmware rev: 03.08.09.00

Base WWN: 5:00a098:007216c:94

Phy State: [8] Disabled

[9] Disabled

[10] Disabled

[11] Disabled

QSFP Vendor: not available

QSFP Part Number: not available

QSFP Type: not available

QSFP Serial Number: not available

slot 4: SAS Host Adapter 4c (PMC-Sierra PM8072 rev. C, SAS, <OFFLINE (hard)>)

MFG Part Number: NetApp, Inc. 110-00401 rev. B0

Part number: 111-02026+B0

Serial number: 031627002139

Date Code: 20160702

Firmware rev: 03.08.09.00

Base WWN: 5:00a098:007216c:98

Phy State: [0] Disabled

[1] Disabled

[2] Disabled

[3] Disabled

QSFP Vendor: not available

QSFP Part Number: not available

QSFP Type: not available

QSFP Serial Number: not available

slot 4: SAS Host Adapter 4d (PMC-Sierra PM8072 rev. C, SAS, <OFFLINE (hard)>)

MFG Part Number: NetApp, Inc. 110-00401 rev. B0

Part number: 111-02026+B0

Serial number: 031627002139

Page 50: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

50 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

Date Code: 20160702

Firmware rev: 03.08.09.00

Base WWN: 5:00a098:007216c:9c

Phy State: [4] Disabled

[5] Disabled

[6] Disabled

[7] Disabled

QSFP Vendor: not available

QSFP Part Number: not available

QSFP Type: not available

QSFP Serial Number: not available

slot 5: 40 Gigabit Ethernet Controller XL710 QSFP+

e5a MAC Address: 3c:fd:fe:a1:9c:d8 (auto-10g_twinax-fd-up)

QSFP Vendor: CISCO

QSFP Part Number: L45593-D178-B50

QSFP Serial Number: LCC1741G0U7

e5b MAC Address: 3c:fd:fe:a1:9c:d9 (auto-10g_twinax-fd-up)

QSFP Vendor: CISCO

QSFP Part Number: L45593-D178-B50

QSFP Serial Number: LCC1741G0U7

e5c MAC Address: 3c:fd:fe:a1:9c:da (auto-10g_twinax-fd-up)

QSFP Vendor: CISCO

QSFP Part Number: L45593-D178-B50

QSFP Serial Number: LCC1741G0U7

e5d MAC Address: 3c:fd:fe:a1:9c:db (auto-10g_twinax-fd-up)

QSFP Vendor: CISCO

QSFP Part Number: L45593-D178-B50

QSFP Serial Number: LCC1741G0U7

Device Type: XL710 4, PBA J27441-002

Firmware Version: fw 5.0 nvm 5.04 etid 800028f2

Serial Number: 3CFDFEA19CD8

Output for vol show Command The following is the output for the vol show command:

stlaurora-7and8::> vol show

Vserver Volume Aggregate State Type Size Available Used%

--------- ------------ ------------ ---------- ---- ---------- ---------- -----

splunksvm nfs_stlrx2540m1_74_splunk_index_vol1

aggr1 online RW 600GB 534.0GB 10%

splunksvm nfs_stlrx2540m1_75_splunk_index_vol1

aggr1 online RW 600GB 533.6GB 11%

splunksvm nfs_stlrx2540m1_76_splunk_index_vol1

aggr1 online RW 600GB 534.9GB 10%

splunksvm nfs_stlrx2540m1_77_splunk_index_vol1

aggr1 online RW 600GB 534.0GB 11%

splunksvm nfs_stlrx2540m1_78_splunk_index_vol1

aggr2 online RW 600GB 540.0GB 10%

splunksvm nfs_stlrx2540m1_79_splunk_index_vol1

aggr2 online RW 600GB 540.0GB 10%

splunksvm nfs_stlrx2540m1_80_splunk_index_vol1

aggr2 online RW 600GB 540.0GB 10%

splunksvm nfs_stlrx2540m1_81_splunk_index_vol1

aggr2 online RW 600GB 540.0GB 10%

splunksvm splunksvm_root

aggr1 online RW 1GB 971.5MB 5%

splunksvm stlrx2540m1_74_splunk_index_vol1

aggr1 online RW 600GB 64.56GB 89%

splunksvm stlrx2540m1_74_splunk_index_vol1_clone_07112017_152639_99

aggr1 online RW 600GB 76.65GB 87%

Vserver Volume Aggregate State Type Size Available Used%

--------- ------------ ------------ ---------- ---- ---------- ---------- -----

splunksvm stlrx2540m1_75_splunk_index_vol2

aggr1 online RW 600GB 62.77GB 89%

splunksvm stlrx2540m1_75_splunk_index_vol2_clone_07112017_153925_14

aggr1 online RW 600GB 70.71GB 88%

splunksvm stlrx2540m1_76_splunk_index_vol3

aggr1 online RW 600GB 60.08GB 89%

Page 51: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

51 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

splunksvm stlrx2540m1_76_splunk_index_vol3_clone_07112017_153944_56

aggr1 online RW 600GB 71.27GB 88%

splunksvm stlrx2540m1_77_splunk_index_vol4

aggr1 online RW 600GB 64.69GB 89%

splunksvm stlrx2540m1_77_splunk_index_vol4_clone_07112017_154003_90

aggr1 online RW 600GB 71.89GB 88%

splunksvm stlrx2540m1_78_splunk_index_vol5

aggr2 online RW 600GB 61.52GB 89%

splunksvm stlrx2540m1_79_splunk_index_vol6

aggr2 online RW 600GB 59.39GB 90%

splunksvm stlrx2540m1_80_splunk_index_vol7

aggr2 online RW 600GB 60.78GB 89%

splunksvm stlrx2540m1_81_splunk_index_vol8

aggr2 online RW 600GB 64.40GB 89%

Vserver Volume Aggregate State Type Size Available Used%

--------- ------------ ------------ ---------- ---- ---------- ---------- -----

splunksvm stlrx2540m1_82_splunk_frd_vol1

aggr1 online RW 600GB 271.5GB 54%

splunksvm stlrx2540m1_83_splunk_frd_vol2

aggr2 online RW 600GB 315.8GB 47%

splunksvm stlrx2540m1_84_splunk_frd_vol3

aggr2 online RW 600GB 198.2GB 66%

splunksvm stlrx2540m1_85_splunk_cntl_mon_vol1

aggr1 online RW 600GB 47.94GB 92%

splunksvm stlrx2540m1_86_splunk_search_head_vol1

aggr2 online RW 600GB 47.94GB 92%

stlaurora-7and8-01

vol0 aggr0 online RW 939.3GB 776.6GB 17%

stlaurora-7and8-02

vol0 aggr0_stlaurora_7and8_02_0

Appendix B: Test Configuration Details

The following two Splunk configurations are referenced in this document:

• Splunk with NetApp AFF A700 FC SAN for indexer storage

• Splunk with DAS internal to the servers

This appendix gives server details for both configurations.

Servers Used with AFF A700 FC SAN Configuration

The following servers were used with the AFF A700 FC SAN configuration:

• Fujitsu Primergy RX2540 M1 servers, each equipped with:

2 CPUs, 16 physical cores total

Intel Xeon CPU E5-2670 v3 @ 2.30GHz

256GB physical memory

2 x 300GB SAS OS drives (mirrored)

1 QLogic QLE2672 QLogic 2-port 16Gb FC Adapter

Note: Figure 2 is a graphical representation of this configuration.

Servers Used with Internal DAS Configuration

The following servers were used with the internal DAS configuration:

• Dell R730xd PowerEdge servers each equipped with:

2 CPUs, 16 physical cores total

Page 52: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

52 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

Intel Xeon CPU E5-2670 v3 @ 2.30GHz

128GB physical memory

4 x 800GB SSD, RAID 10

12 x 1.2TB SAS RAID 10

2 x 600GB SAS OS drives (mirrored)

Note: Figure 9 is a graphical representation of this configuration.

Figure 9) DAS configuration.

Acknowledgements

• Karthik Nagalingam, Senior Architect (Big Data Analytics & Databases), NetApp

• Keith Griffin, Lab Support Engineer, NetApp

• Laura Finkelstein, Director of Product Management, NetApp

• Scott Lane, Senior Manager, Workload Engineering and Performance Measurement, NetApp

• Mitch Blackburn, Technical Marketing Engineer, NetApp

• Paul Burland, Sales Representative, NetApp

• Nilesh Bagad, Senior Product Manager, NetApp

• Krister Eriksson, Senior Product Manager, NetApp

• Mike McNamara, Senior Manager, Product Marketing, NetApp

• Jim Farney, Senior Product Manager, NetApp

• Austin Albrecht, Consulting Engineer, Global Technology Resources, Inc. (GTRI)

Where to Find Additional Information

To learn more about the information presented in this document, refer to the following documents and

websites:

• Global Technical Resources, Inc. (GTRI)

http://www.gtri.com/

Page 53: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

53 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

• NetApp All Flash Arrays product page https://www.netapp.com/us/products/storage-systems/all-flash-array/aff-a-series.aspx

• NetApp ONTAP Data Management Software product page

http://www.netapp.com/us/products/data-management-software/ontap.aspx

• Splunk https://www.splunk.com/

• Splunk App for NetApp Data ONTAP

https://splunkbase.splunk.com/app/1293/

• TR-4623: NetApp E-Series E5700 and Splunk Enterprise http://www.netapp.com/us/media/tr-4623.pdf

Version History

Version Date Document Version History

Version 1.0 December 2017 Initial release.

Page 54: TR-4650: NetApp ONTAP and Splunk Enterprise · Technical Report NetApp ONTAP and Splunk Enterprise ONTAP Performance and Reliability in a Splunk Enterprise Environment Data Fabric

54 NetApp ONTAP and Splunk Enterprise © 2017 NetApp, Inc. All rights reserved.

Refer to the Interoperability Matrix Tool (IMT) on the NetApp Support site to validate that the exact product and feature versions described in this document are supported for your specific environment. The NetApp IMT defines the product components and versions that can be used to construct configurations that are supported by NetApp. Specific results depend on each customer’s installation in accordance with

published specifications.

Copyright Information

Copyright © 2017 NetApp, Inc. All rights reserved. Printed in the U.S. No part of this document covered by copyright may be reproduced in any form or by any means—graphic, electronic, or mechanical, including photocopying, recording, taping, or storage in an electronic retrieval system—without prior written permission of the copyright owner.

Software derived from copyrighted NetApp material is subject to the following license and disc laimer:

THIS SOFTWARE IS PROVIDED BY NETAPP “AS IS” AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL NETAPP BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT

LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

NetApp reserves the right to change any products described herein at any time, and without notice.

NetApp assumes no responsibility or liability arising from the use of products described herein, except as expressly agreed to in writing by NetApp. The use or purchase of this product does not convey a license under any patent rights, trademark rights, or any other intellectual property rights of NetApp.

The product described in this manual may be protected by one or more U.S. patents, foreign patents, or pending applications.

RESTRICTED RIGHTS LEGEND: Use, duplication, or disclosure by the government is subject to

restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS 252.277-7103 (October 1988) and FAR 52-227-19 (June 1987).

Trademark Information

NETAPP, the NETAPP logo, and the marks listed at http://www.netapp.com/TM are trademarks of NetApp, Inc. Other company and product names may be trademarks of their respective owners.

TR-4650-1217


Recommended