NOTE: This app is deprecated and should be replaced in your UCS environment by the Splunk Add-on for Cisco UCS (https://splunkbase.splunk.com/app/2731). This newer add-on is officially supported by Splunk and has several benefits over this app regarding the data collection. While it does not have any dashboards, there are several prebuilt panels which lead to a *very* fast dashboard building experience.
Analytics for Cisco UCS combines the power and flexibility of Splunk with a tailored experience for Cisco UCS. This app gathers data from one or more Cisco UCS Managers enabling you to:
* Gain real time and historical visibility centrally across your entire UCS deployment
* Correlate UCS performance, fault and events data with user, application, hypervisor data to analyze, prevent and fix problems
* Proactively monitor your Cisco UCS environment by providing analytics such as available capacity, trending of faults over time, tracking of power & cooling costs
This app is authored by Splunk but is not officially supported by Splunk Support. If you have a current Splunk Enterprise Support entitlement, Splunk will provide best-effort support for cases involving this app directly, but such cases will not be subject to the Splunk Enterprise Support SLA.
ABOUT THIS APP
The Splunk App for Cisco UCS combines the power and flexibility of Splunk with a tailored experience for Cisco UCS. Splunk for Cisco UCS gathers data from one or more Cisco UCS Managers enabling you to:
- Gain real time and historical visibility centrally across your entire UCS deployment
- Correlate UCS performance, fault and events data with user, application, hypervisor data to analyze, prevent and fix problems
- Proactively monitor your Cisco UCS environment by providing analytics such as available capacity, trending of faults over time, tracking of power & cooling costs
- Central operational view across multiple UCS domains
- Trending of faults over time, by cause and by impacted assets
- Trending of power consumption, cooling requirements and networking throughput over time
- Authentication tracking
- Ability to correlate UCS data with other data in Splunk such as virtualization or application data
This app "suite" consists of four apps. They can be installed on a single-server or distributed Splunk install.
* SplunkAppForCiscoUCS - This is the main dashboard app. It should be deployed only to your search head tier in a distributed install.
And under the folder SplunkAppForCiscoUCS/appserver/addons, are the following:
- Splunk_TA_CiscoUCS - This is the "collector" or "technology add-on" and does the work of collecting data from UCS Manager systems. It consists of a set of Python scripts which are executed by Splunk as scripted inputs. This app should be deployed to Splunk lightweight forwarders in a distributed install.
- Splunk_TA_CiscoUCS_Syslog - This is an optional app which enables syslog inputs on your Splunk server. Deploye this app to your index tier in a distributed install.
- Splunk_KB_CiscoUCS - This "knowledge app" contains configuration files which should be deployed to both your indexers and search heads in a distributed install. Note: this app contains indexes.conf. This will create indexes on your search head, but they are not used, because your forwarder is configured to send data only to the indexers. If the extra indicies bug you, remove indexes.conf from the app when installing to your search head.
The Technology Add-On "Splunk_TA_CiscoUCS" has the following requirements:
Splunk version 4.3 or later. If using a forwarder, it must be a LIGHTWEIGHT forwarder. (We use the LWF because the Universal forwarder does not include Python.) For info on how to deploy a LWF, see http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Deployaforwarder The forwarder system must have network access (HTTP/HTTPS) to one or more UCS Managers which are to be Splunked.
* A read-only user ID and password for collecting data from UCS Manager.
The syslog Technology Add-On "Splunk_TA_CiscoUCS_Syslog" has the following requirements:
* Each UCS Manager should be configured to send syslog messages to your Splunk Indexer(s). Complete instructions can be found here: http://www.cisco.com/en/US/products/ps10281/products_configuration_example09186a0080ae0f24.shtml. Be sure to use the "info" level (very important!). The rest of the settings can be left at their defaults.
HOW TO INSTALL
See included README.md in package.