Managing Splunk Accounts

This chapter contains the following sections:

Cisco UCS Director Express for Big Data with Splunk Enterprise

Cisco UCS Director Express for Big Data with Splunk Enterprise deployment reliably collects and indexes machine data, from a single source to tens of thousands of sources, all in real time. Splunk Enterprise deployments expand to terabytes of operational data. Cisco UCS Director supports the massive scalability that Splunk Enterprise deployments to deliver exceptional performance.

Splunk Enterprise deployments consist of Cisco UCS as indexer and C220 M4 Server as search heads, along with administrative functions.

Splunk Enterprise deployments include the following:

  • Cisco UCS

  • Cisco UCS C-Series Rack-Mount Servers

  • Cisco UCS Manager

Adding a Splunk Account

If you want to manage your Splunk cluster using Cisco UCS Director Express for Big Data, add a Splunk account.

Procedure

Step 1

Choose Solutions > Big Data > Accounts.

Step 2

Click Splunk Accounts.

Step 3

Click Add.

Step 4

On the Add Account screen, complete the following fields:

Name Description

Pod drop-down list

The pod to which the Splunk account to be added.

Account Name field

The Splunk account name.

Management Console IP field

The management console IP address.

SSH (Root) Password field

The password associated with the SSH username.

Confirm Password field

The password associated with the SSH username.

Monitoring Console Protocol drop-down list

Choose HTTP or HTTPS protocol.

Monitoring Console Port Number field

Enter the port number. Enter an integer between 1024 and 65535.

Splunk Manager Password field

The password associated with the Splunk Enterprise.

Confirm Password field

The password associated with the Splunk Enterprise.

Step 5

Click Submit.

Step 6

For the following actions, select a Splunk account.

Name

Description

Edit

Allows you to edit a Splunk account.

Delete

Deletes a Splunk account.

Check Configuration

Allows you to validate an existing cluster configuration.

Rollback Cluster

Allows you to roll back a cluster and make all the nodes in the cluster available for a bare metal server. Roll back is not supported for a derived cluster account.

Launch Splunk DMC

Allows you to launch the Splunk Enterprise from Cisco UCS Director Express for Big Data.

View Details

Provides details of a Splunk account.

Run Inventory

Collects the inventory of the Splunk cluster for the selected Splunk account and establishes data in the Cisco UCS Director Express for Big Data database.

Modify Credentials

Allows you to modify the SSH, admin Console credentials, and monitoring console protocol and port details for a Splunk account.

Running a Cluster Inventory for a Splunk Account

With each new Splunk Account, a new system task (inventory collector) is created. Navigate to the Big Data Tasks folder here: Administration > System > System Tasks. The system task collects the inventory of the Splunk cluster for the selected Splunk Account and establishes data in the Cisco UCS Director database. This collector adds to the system scheduler so that it can be called at the interval configured in the collector (for example, 30 minutes).

For more information on how to manage system tasks in Cisco UCS Director, see the latest Cisco UCS Director Administration Guide.

Procedure

Step 1

Choose Solutions > Big Data > Accounts.

Step 2

Click Splunk Accounts.

Step 3

Choose the Splunk Account for which you want to run the inventory.

Step 4

Click Run Inventory.

Step 5

Click Submit.

Rolling Back a Cluster for a Splunk Account

You can roll back a cluster and make all the nodes in the cluster available for a bare metal server. However, roll back is not supported for a derived cluster account.

Procedure

Step 1

Choose Solutions > Big Data > Accounts.

Step 2

Click Splunk Accounts.

Step 3

Choose the Splunk account for which you want to roll back the cluster.

Step 4

Click Rollback Cluster.

Step 5

On the Rollback Cluster screen, click Submit.

Access Splunk Enterprise Monitoring Console User Interface from Cisco UCS Director Express for Big Data

You can access the Splunk Enterprise user Interface from Cisco UCS Director Express for Big Data. On the menu bar, choose Solutions > Big Data > Accounts, and then click Splunk Accounts. You can launch the Splunk Enterprise user interface in supported browsers by clicking the Launch Splunk DMC.