PureStorage Unified App for Splunk

Troubleshooting

1) Dashboard is not showing any data.

• By default, the App searches for the PureStorage FlashArray or FlashBlade data against the Splunk index main. If you configured a custom index in the PureStorage Unified Add-on to host the PureStorage data, please do the following so the dashboards will show the data.
• Go to Settings => Advanced Search => Search Macros on the Splunk instance where you have installed the PureStorage Unified App (ps_unified).
• Click the macro get_ps_flashblade_index and update the index value with the custom index that you have configured for PureStorage FlashArray and/or FlashBlade and press Save.
• Make sure you have data in the given time range. If not, try expanding the time range.
• Check if the FlashArray and/or FlashBlade data is collected into Splunk by running the following query in the search under PureStorage Unified App context. `get_ps_flashblade_index` |stats count by sourcetype

  2) Dashboard performance is slow.

• Enable the accelerated data models for the PureStorage Unified App which are disabled by default. Note: Enabling acceleration on the data models increases the disk usage on the indexer but certainly improves the dashboard performance.
• The PureStorage Unified App consists of two data models PureStorage FlashBlade and PureStorage FlashArray.
• Admin should manually accelerate the Data Model.
  • The recommended acceleration period is 7 days.
  • Enable/disable or modify the acceleration by following the steps:
    • Click Settings => Data Models from the Splunk GUI where the PureStorage Unified App is installed.
    • From the list of Data Models, click Edit under the Actions column against the specific Data Model and select Edit Acceleration.
    • Check or uncheck the Accelerate radio box to Enable or disable the acceleration.
    • If you are enabling the Acceleration, select your choice of summary range and click Save.