FlashBlade Monitoring on Splunk with FlashBlade App and TA

Last updated
Save as PDF

Overview

A Splunk App is a prebuilt collection of dashboards, panels and UI elements packaged for a specific technology.

A Splunk technology add-on (TA) is a type of app that generally used for getting data in, mapping data, or providing saved searches and macros.

In summary, Splunk App provides a front end for visualizing data while Add-on provides back end functionality to define the data and get them into Splunk. Splunk app is a bundle of config files with some scripts and some UI related components in html or django.

The Pure FlashBlade TA for Splunk enables the customer to connect to their fleet of FlashBlades through Pure Storage Python REST client to collect and ingest data from them using REST API calls. The data gathered include basic array information, performance metrics (bandwidth, iops, latency), filesystems, objects, accounts.

The Pure FlashBlade app for Splunk is a prebuilt collection of detailed dashboards and context-based drill-down capabilities to monitor various components of FlashBlade like Filesystems, Objects, Policies, and analyze trendings like performance and capacity.

FlashBlade App & TA - Architecture

As the FlashBlade technology add-on (TA) runs on Splunk Enterprise ideally it should be installed on Heavy Forwarders or Search Heads which runs Splunk Enterprise.

The FlashBlade App should be installed on the Search Head.

Pure FlashBlade App & TA Installation

Download Pure FlashBlade TA from splunkbase.splunk.com at https://splunkbase.splunk.com/app/4524/ and Pure FlashBlade app at https://splunkbase.splunk.com/app/4525/
Login to the Splunk Web home screen, click the gear icon next to Apps (You can install TA on the Search Head, or a Heavy Forwarder that has network access to the FlashBlade(s) and FlashBlade App on Search Head).
Click Install app from file
Locate the downloaded Pure FlashBlade TA file and click Upload. If you are upgrading the app with the latest version, check the Upgrade app checkbox.
If Splunk Enterprise prompts you to restart, click Restart Later so we can install the FlashBlade App as well before restarting the Splunk instance.
Click Install app from file again.
Locate the downloaded Pure FlashBlade App file and click Upload.
If Splunk Enterprise prompts you to restart, click Restart Now. If not, perform the Restart of the instance through Settings => Server Controls => Restart Splunk.
Verify that the add-on and the app appear in the list of apps on the left side of the Splunk Web home screen.

Pure FlashBlade TA Configuration

Perform the following steps to add data inputs from FlashBlades into Splunk. The sequence is to configure the account detail(s) for a FlashBlade (FlashBlade host address, api-token) followed by the data input definitions as the data input requires the account to connect to. If you have to configure say three FlashBlades, you should be creating three accounts each one with the connection details and credentials, followed by three data inputs for each one of them.

Click the “PureStorage FlashBlade Add-On For Splunk” under the Apps frame on the left side.
Click the Configuration tab under the FlashBlade Add-On page.
Click the Add button on the right side of the page to add a new input.
Enter an account name, FlashBlade management IP address, API token for the account that would be used to extract the FlashBlade log data. Check the “Verify SSL Certificate” checkbox if the SSL certificate has to be validated.
1. To get the API token, run the following CLI command on the FlashBlade by connecting over SSH with the account that will be used to connect by the Splunk inputs.
  1. To create the api-token for the very first time
```
pureadmin create --api-token
```
  2. To get the existing api-token
```
pureadmin list --api-token --expose
```
Click the Inputs tab to configure a new input for the FlashBlade configured.
Click the Create New Input button at the top right.
Enter the details for the new input and press Add.
1. A unique Name for the data input
2. Interval in seconds. The default is 5 minutes or 300 seconds.
3. Select an index where the FlashBlade log data to be stored.
4. Select the Account that was created earlier which would be used to connect to the FlashBlade to extract the logs.
5. Specify the Start Date from which the FlashBlade log details to be extracted. Any entities like filesystems, S3 buckets, alerts, snapshots that were created prior to this date will not be extracted. This is very critical if you wanted to extract all the data since the FlashBlade was put into production as the default is 7 days.
Splunk should start extracting the FlashBlade log data through the python REST API which will be used by the FlashBlade App to show detailed dashboards and context-based drill-down capabilities to help monitor various components of FlashBlade like filesystems, objects, policies, alerts and analyze trendings like performance and capacity.