Aviz ONE Data Lake details Splunk instance setup and metric streaming

Aviz released ONE Data Lake as part of ONES 2.1 and describes an integration path to Splunk for streaming network telemetry to a chosen Splunk instance. The update matters for enterprise security and operations teams that monitor network health and traffic across multi-vendor environments.

Research Overview

The post explains that a data lake is a centralized storage approach for structured, semi-structured, and unstructured data, commonly implemented with scalable cloud storage such as Amazon S3, Azure Data Lake Storage, or Google Cloud Storage. It frames Aviz ONE-Data Lake as a cloud platform for migrating on-premises network data to cloud storage.

According to the post, ONE-Data Lake collects metrics across the network control plane, data plane, system, platform, and traffic. It is described as an upgraded iteration of Aviz Open Networking Enterprise Suite (ONES), with the metrics previously used in ONES stored in the cloud.

Key Findings

The blog positions Splunk as a tool used for operational monitoring, security event management, regulatory reporting, IT operations and DevOps, machine learning and predictive analytics, and customer feedback analysis. It presents Splunk as relevant across monitoring, detection, and reporting use cases.

For the specific integration, the post outlines how to set up Splunk instances in ONES cloud and stream selected metrics to a Splunk endpoint. It also describes how users manage the created integration through ONES after setup.

Technical Breakdown

The integration workflow starts with mapping a Splunk instance to the ONES server. The post says users configure Splunk instances on the ONES cloud page so metrics can be pushed to a designated cloud endpoint.

The required integration details include the Splunk URL, a unique token for authentication and secure data transmission, and the Splunk index where metrics are stored. After configuration, the blog states users can update integration settings, pause or resume metric uploads, and delete the created integration in ONES.

Operational Impact

The post states that end users can select which metrics from their ONES-monitored network are uploaded to the cloud service. It lists supported metrics categories as Traffic Statistics, ASIC Capacity, Device Health, and Inventory, with administrators able to choose which metrics to upload.

For multi-vendor operation, the blog describes that streaming is not limited to a single network operating system. It says the data collection works across Cisco NX-OS, Arista AOS, SONiC, and Non-SONiC, using gNMI on SONiC-supported devices and SNMP on operating systems from other vendors.

Splunk Analytical Capabilities

The blog explains that Splunk events include timestamped data plus metadata, and that events are parsed and indexed separately. It says Splunk extracts fields from events during indexing, enabling filtering and correlation based on those fields.

It also describes chart representation as visual depictions of data using charts or graphs, such as bar charts, line charts, pie charts, and scatter plots. The post includes examples tied to inventory details captured as events and visualizations showing data across different NOS vendors.

The blog outlines how Aviz ONE-Data Lake in ONES 2.1 streams network telemetry to Splunk by configuring a Splunk endpoint in ONES, supplying URL/token/index details, selecting metrics to upload, and managing the integration lifecycle. It links that streamed telemetry to Splunk’s event parsing and charting approach for multi-vendor network monitoring, and this “Blog Signals brief” is a fact-based summary of the vendor blog.