It's hard to tell without looking at your environment. I would take a look at the logs splunk is generating to see what kind of errors they're generating. Here are the places that would be good to start with are any logs starting with hydra_* (from the app SA-Hydra) and with ta_ontap* - search for errors within there. From your initial problem statement, it seems that you just aren't receiving any data for just the volumes. For this I would suggest that you download zexplore from netapp, and with that, check to see if you can get the volume perf data from the filer using their api (they should have documentation here to show you how to do that). If you can use that tool, check and see what the log messages are. There might be an issue with data collection with that particular source.,It's hard to tell without looking at your environment. I would take a look at the logs splunk is generating to see what kind of errors they're generating. Here are the places that would be good to start with are any logs starting with hydra_* (from the app SA-Hydra) and with ta_ontap* - search for errors within there. From your initial problem statement, it seems that you just aren't receiving any data for just the volumes. For this I would suggest that you download zexplore from netapp, and with that, check to see if you can get the volume perf data from the filer using their api (they should have documentation here to show you how to do that). ... View more

There is a long and storied history with this kind of use case (breaking up json data in this way). Unfortunately, all of the solutions are as elegant as a drunken hippo in a bouncy castle. Here's something that might work: | spath output=groupName path=responseEntity{}.groupName | rename responseEntity{}.counters.SearchResult.close().count AS count | eval x=mvzip(groupName,count)|mvexpand x|eval x=split(x,",")|eval groupName = mvindex(x,0)|eval count = mvindex(x,1)| table groupName,count What's going on here is we're zipping together the values (in order) of the two fields (with mvzip) then turning those into separate events based on the field (with mvexpand), then splitting those zipped fields into their original components (with split and mvindex). ... View more

There shouldn't be any issue with deploying this on SUSE, although it was not officially supported. If you try it and it doesn't seem to work, post it here and we can work through it. ... View more