Splunk Plug-In

The Splunk plug-in obtains the webserver URL, username and password, and then it communicates with the webserver to verify the credentials. Using these credentials and the Commvault API, the plug-in obtains all the clients associated with the CommCell Console. Splunk indexer IP, indexer receiver port and index name are taken as input. For automating the installation of Splunk forwarder on the client, the Splunk forwarder software path on the local machine (where plug-in is installed) is also taken as an input. The selected clients are then checked for the Splunk software. If the Splunk software does not exist on any client, then the Splunk forwarder is installed on the client from the Splunk forwarder software path and the CVD service running on the client. Based on the indexer IP, management port and index name, the client is then configured to monitor the log files. If the required information to configure the client is not available, the client is staged, and the configuration continues only after obtaining the required information. Using the plug-in you can update the index name and Splunk related information, such as, Splunk credentials and Splunk management port.

You can use the Splunk plug-in to monitor the duration and the status of Commvault jobs, and to monitor the Commvault logs.

Install the Plug-In

1. From the Commvault Store or SplunkBase, download the Splunk plug-in.

2. Log on to the Splunk URL.

3. From the Home page, click the settings button.

4. The Apps page appears.

5. Click Install app from file.

6. The Upload app page appears.

7. Browse to and select the commvaultplugin.spl Splunk plug-in file, and then click Upload.

Before You Begin

• On the computer where the indexer peer nodes are configured, configure the receiving port.

  To configure the receiving port, from the Home page, navigate to Settings > Forwarding and receiving > Configure receiving > New Receiving Port.

• On the computer where the receiving port is configured, create a new index. You can also use an existing index if you have one on the computer where the receiving port is configured.

  To create a new index, from the Home page, navigate to Settings > Indexes > New Index.

Configurations

Set Up the CommCell Page

1. On the CommCell tab, enter the webserver URL.

2. Enter the CommCell user name and password, and then click Add CommCell.

   The CommCell user must have the following permissions:

   • Access Policies:

     • Add, delete and modify folders

   • Client

     • Agent Management

     • Browse

     • Download

     • End User Access

     • Run Command with System Account

     • Run Command with User Account

     • Upload

   • Developer Tools

     • Reports

     • Add Report

     • Delete Report

     • Edit Report

     • Execute Report

   • Global

     • Report Management

     • View

3. Append the webserver URL with the IIS port number, such as <webserver_url>:<IIS port number>. The default port number is 81.

Set Up the Commvault Clients Page

1. On the Commvault Clients tab, select a CommServe client, and then click Submit.

2. From the Unmonitored Clients section, select the CommServe client and other clients to monitor.

3. Click Monitor Selected Clients.

Set Up the Splunk Configuration Page

1. On the Splunk Configuration tab, from the IndexName list, select the name of an index.

2. Enter the IP of the indexer and the receiving port number.

3. Click Submit.

If you have not installed the Splunk software on the Commvault client computer, depending on the operating system installed on the client computer, enter the Windows or UNIX path of the Splunk forwarder software. You must enter a .msi file path for Windows and a .tgz file path for UNIX.

If you have another Splunk software running on a client computer, configure the outputs.conf file to point the forwarder to the computer where Splunk indexer is installed. Also, enter the credentials of the Splunk software in the Forwarder Configuration Table. Ensure that this client computer is a monitored client.

Result

On the Commvault Dashboard tab, you can see the pie charts of the duration and the status of Commvault jobs. Click the pie chart to get the job details. Click on a job ID to get the job logs.

Additional Information

To view the events for troubleshooting, you can check the SplunkPlugin.log file in the SPLUNK_HOME/etc/apps/commvault/local folder.

Requirements

Commvault software version: V11 with Feature Release 20 (or the most recent).