EMC VNX App for Splunk Enterprise: Why are some of the prebuilt panels not getting populated with data?

[mtime24]

Hello,

I've recently deployed the EMC VNX App for Splunk Enterprise on my Splunk instance and not all of the prebuilt panels are working. For instance, the storage processor response time, storage processor write time, top 10 block device writes, and top 10 block device reads are not working. All of the other prebuilt panels are working. Do I have to do anything on the array such as enabling statistics logging in order for these panels to work?

[mtime24 · Accepted solution]

apparently all i had to do was to enable performance logging on the array and just like that all the prebuilt charts started populating with information.

[mtime24]

jkat54....thanks for the tip, I look at the apps settings which I normally never do and there are tons of predefined sourcetypes in there which i will have to explore....thanks!

[jkat54]

I converted this to the answer please mark it as such @mtime24

[mtime24]

thanks for the help

[jkat54]

No problem, you're welcome to upvote any comment that helped you 😉

[jkat54]

Sometimes you have to enable additional splunk inputs included in the app, sometimes you have to enable additional outputs from the device.

Best method to troubleshoot is to click on "open in search" in lower left corner of the panel, see what data it is looking for and then trace that backwards / reverse engineer to find why you're missing the data. It could be something as simple as specifying the index name in a search macro.