PureStorage Unified Add-on Configuration

Perform the following steps to add data inputs from FlashArrays and/or FlashBlades into Splunk. The sequence is to configure the account detail(s) for an array (FlashBlade host address, api-token) followed by the data input definitions as the data input requires the account to connect to. If you have to configure say three FlashArrays, you should be creating three accounts each one with the connection details and credentials, followed by three data inputs for each one of them.

Click the “PureStorage Unified TA” under the Apps frame on the left side.
Click the Configuration tab under the PureStorage Unified TA page.
Click the Add button on the right side of the page to add a new account.
Enter a system name, select the array type (FlashBlade or FlashArray), system address (in FQDN format), API token for the account that would be used to extract the array log data.
1. As Splunk has mandated the connection between the Splunk instance and the array to be encrypted and hence there is no more option of disabling the VERIFY_SSL option.
  1. This means the FlashArray or FlashBlade that you are connecting to should have a commercial SSL certificate installed and the array address should reflect that name.
  2. If you are not using a commercial SSL certificate rather using the self-signed certificate provided by Everpure, please make sure the system name matches the "Common Name" of the digital certificate. If not, generate a new self-signed certificate with the "Common Name" same as the system address (FQDN) and "Valid To" field set with an expiry date for the certificate. Please see this Self-signed Certificates with FA/FB for PureStorage Unified Add-on for more details on how to generate a new self-signed certificate for FlashArray or FlashBlade.
    1. Please add this certificate to $SPLUNK_HOME/etc/apps/TA-purestorage-unified/bin/ta_purestorage_unified/aob_py3/certifi/cacert.pem file and $SPLUNK_HOME/etc/apps/TA-purestorage-unified/bin/ta_purestorage_unified/aob_py2/certifi/cacert.pemfile.
    2. For adding a certificate on the Splunk Cloud instance, raise a Splunk support ticket.
2. To get the API token, run the following CLI command on the FlashArray or FlashBlade by connecting over SSH with the account that will be used to connect by the Splunk inputs.
  1. To create the api-token for the very first time
```
pureadmin create --api-token
```
  2. To get the existing api-token
```
pureadmin list --api-token --expose
```
3. Repeat the above steps (3 & 4) for configuring all your FlashArrays and FlashBlades from which you wanted to extract the log details into Splunk.
Click the Inputs tab to configure a new input for the account that was configured above.
Click the Create New Input button at the top right.
Enter the details for the new input and press Add.
1. A unique Name for the data input
2. Interval in seconds. The suggested interval is 300 seconds but choose your desired interval to extract information from the array.
3. Select an index where the log data to be stored.
4. Select the Account that was created earlier which would be used to connect to the Pure array to extract the logs.
5. Specify the Start Date from which the array log details (like alerts, audits, performance metrics) to be extracted. If you want to extract all the available performance metrics, specify an earlier Start Date like the date when the array was installed.
Repeat the above steps (6 & 7) for configuring the inputs for all your FlashArrays and FlashBlades that were configured earlier.
Splunk should start extracting the log data from the array through the Python REST API which will be used by the PureStorage Unified App to show detailed dashboards and context-based drill-down capabilities to help monitor various components of FlashArray and FlashBlade.