All Apps and Add-ons

How can I configure index specification in PureStorage-Technology add-on?

davebo1896
Communicator

Not a lot of info on how to configure this.
Do you have any documentation?

The app installs as "visible", but there are no setup pages installed.

I see a README/inputs.conf.spec, but that doesn't look like it is going to encrypt the password.
There is also no index specification in the inputs.conf.spec , and looking at the associated app, it looks like I'm going to have to add in a macro to all the dashboards to specify an index, so you don't sweep over every allowed index for every configured query. The inputs.conf.spec also doesn't have a frequency setting.

This doesn't seem ready-for-prime-time. Am I missing something?

0 Karma
1 Solution

davebo1896
Communicator

Found it.
The instructions are in the README.txt inside the tar.

Install the TA on your indexers for the ingest props.conf.
Optionally create an index for this data if you prefer that over default

Install the TA on a Heavy forwarder or search head ( I'm not sure if this will work in a SHC, probably best to avoid that )
Create a new Data Input via the GUI.
From the README.txt:

There is no specific configuration required to get the app running. However, you will need to connect the arrays as data inputs. Please >use the following steps to connect an array

  1. Go to Settings -> Data Inputs
  2. Click "PureStorage Array Rest API"
  3. Click "New"
  4. Fill out the array name, IP address, username, and password (readonly access required)
  5. Change the "Interval" within "More settings" if desired.

Note: More settings can also be used to set the index, if you configured a custom index

Install the PureStorage-App on your search head(s), add the custom index to allowedIndexes and defaultIndexes for the appropriate role.
If you don't want this in defaultIndexes, you'll have to customize the app with a macro defining your custom index and update all dashboards and eventtypes to use the macro.

Also, review the permissions, it defaults to wide-open access

[]
access = read : [ * ], write : [ * ]

View solution in original post

0 Karma

davebo1896
Communicator

Found it.
The instructions are in the README.txt inside the tar.

Install the TA on your indexers for the ingest props.conf.
Optionally create an index for this data if you prefer that over default

Install the TA on a Heavy forwarder or search head ( I'm not sure if this will work in a SHC, probably best to avoid that )
Create a new Data Input via the GUI.
From the README.txt:

There is no specific configuration required to get the app running. However, you will need to connect the arrays as data inputs. Please >use the following steps to connect an array

  1. Go to Settings -> Data Inputs
  2. Click "PureStorage Array Rest API"
  3. Click "New"
  4. Fill out the array name, IP address, username, and password (readonly access required)
  5. Change the "Interval" within "More settings" if desired.

Note: More settings can also be used to set the index, if you configured a custom index

Install the PureStorage-App on your search head(s), add the custom index to allowedIndexes and defaultIndexes for the appropriate role.
If you don't want this in defaultIndexes, you'll have to customize the app with a macro defining your custom index and update all dashboards and eventtypes to use the macro.

Also, review the permissions, it defaults to wide-open access

[]
access = read : [ * ], write : [ * ]

0 Karma

davebo1896
Communicator

Mea Culpa,

As regards the defaultIndexes ...
The app does make use of eventtypes.conf , allowing relatively easy insertion of a specific index.
copy eventtypes.conf to local and add the index to the search.

0 Karma

sysadmin_ingeni
New Member

Same issue here, how to configure this?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...