FarSight by Vello

FarSight by Vello provides a collection of dashboards for Splunk® Enterprise that correlate network activity with applications performance monitoring, enabling administrators to fine-tune networking resources in real-time for optimal performance. FarSight facilitates efficient enterprise resources allocation and cost-effective capacity planning.

Downloadable FarSight template

To understand the power of FarSight, we have created an interactive template that you can download to your PC and install to a local instance of Splunk Enterprise. The template simulates a distributed application and network during both expected and abnormal operating conditions. FarSight’s dashboard stitches together statistics of individual flows within the shared bandwidth on switch ports, providing metrics on end-to-end services and gives operators insight into what’s happening on the network in real-time as well as historical views of network activity. When network issues arise, administrators can perform root cause analysis and problem remediation immediately.

The diagram below shows the architecture of the template. An enterprise network application is simulated in which clients connect to an application server that is backed onto a database. These application components are assumed to be running on physically disparate machines in the data center and communicate via interconnected switching hardware as shown in the diagram below. Also shown is a SAN array that is used periodically for database backup. VellOS configures, orchestrates and automates the network on behalf of the storage and compute resources.

The template initially shows application and network statistics to understand their respective states under normal load. Splunk is used to collect, analyze and report on machine data from all elements of the system including, web client, database, application web server as well as data collected from VellOS and the OpenFlow-enabled switches. Once baseline behavior is established, it simulates an unanticipated low-priority database backup that causes switch link saturation and degradation of enterprise application performance.

By understanding the real-time network behavior including flows and switch port bandwidth, flows per switch, and allocated capacity, and correlating them with applications and services, administrators can immediately respond to the demands that the application is placing on the network. This deeper insight into traditionally siloed elements of your data center and WAN infrastructures helps increase your operational efficiency by appropriately allocating enterprise resources and reducing MTTR.


For fastest response to setup, support or help related questions, please email support@vellosystems.com or post to http://answers.splunk.com and tag your question with vellosystems. For product or sales related questions please email splunk@vellosystems.com


Please note: This template is designed to generate simulated traffic and should not be installed in a production Splunk environment. If you do not have a non-production copy of the latest version of Splunk to run FarSight against, it can be downloaded here.

This template ONLY works on Splunk 5.x


FarSight by Vello Systems requires the following:


  • Ensure that the software listed in the Dependencies section is installed.
  • Install FarSight by Vello into Splunk as described in the Splunk documentation.
  • In Splunk, the template landing page contains a detailed quick start guide.