Configuring ThousandEyes for Splunk Cloud or Enterprise using the UI

This section describes how to create data streams using the ThousandEyes application UI. For information on creating integrations and data streams using the API, see Configuring ThousandEyes for Splunk Cloud or Enterprise Using the API

Prerequisites

To configure ThousandEyes for OpenTelemetry using the UI, ensure you meet the following requirements:

• Your user role must have the following permissions:

  • Edit streaming integrations, to view and manage integrations.

  • View streaming integrations, to view details about integrations.

  • View labels, to assign API tags to an integration.

  • View tests to assign CEA (Cloud and Enterprise Agents) tests to a stream.

  • View endpoint tests to assign endpoint tests to a stream.

Prepare Your Splunk Instance

To configure ThousandEyes for Splunk, ensure that the HTTP Event Collector (HEC) is enabled in your Splunk instance. Follow these resources for more information:

• Configure HTTP Event Collector on Splunk Cloud Platform

• Configure HTTP Event Collector on Splunk Enterprise

Steps to Prepare Splunk

1. (Optional) Create an index to specify whether the data will be received as events or metrics. For detailed instructions on creating an index, see Splunk’s documentation : Set up multiple indexes.

   

   Index
2. Create an HTTP Event Collector (HEC) token in your Splunk instance.

3. Optionally, associate the token with the created index for data routing.

4. Identify the target endpoint. Use the appropriate target endpoint based on your Splunk deployment:

   • Splunk Cloud Platform:

     • events: https://http-inputs-<host>.splunkcloud.com:443/services/collector/event

     • metrics: https://http-inputs-<host>.splunkcloud.com:443/services/collector

   • Splunk Enterprise:

     • events: https://<host>:8088/services/collector/event

     • metrics: https://<host>:8088/services/collector

Note: ThousandEyes for OpenTelemetry does not currently support Splunk trial accounts, due to an issue with TLS self-signed certificates.

Create an Integration

Step 1: Create a Connector

To create a new integration, do the following:

1. In the ThousandEyes platform, go to Integrations > Integrations 2.0.

2. Click + New Connector to select the type of a connector to configure.

3. Click Splunk Cloud Platform HEC or Splunk Enterprise HEC depending on your target.

Select Splunk HEC Connector

Step 2: Fill Out the Configuration Form

Fill out the following mandatory fields:

• Name: A name for your connector.

• Target: The target URL of the integration, which may include the port, such as https://http-inputs-<host>.splunkcloud.com:443/services/collector/event for Splunk Cloud Platform or https://<splunk_hostname>/services/collector/event for Splunk Enterprise.

When you create a stream, the target URL must satisfy the [Stream endpoint URL requirements](https://docs.thousandeyes.com/product-documentation/integration-guides/custom-built-integrations/opentelemetry/configure-splunk-integrations#url-target-requirements).

• Token: Enter the Splunk HEC token.

Creating a ThousandEyes for OpenTelemetry to Splunk Enterprise connector

Step 3: Save the Connector

After completing the form, click Save & Assign Operator to save the connector. This connector will now be visible in the list view (Connectors tab).

Step 4: Create an Operation

After creating a connector, you can set up an operation to stream data to the target and assign it to the connector.

1. Click + New Operation to open the menu for selecting the operation type.

2. Choose Splunk Enterprise, Splunk Cloud Platform to proceed to the configuration form.

3. Fill out the configuration form:

   • Complete the following mandatory field: * Operation Name: A name for your operation.

   • (Optional) Configure the following mandatory fields: * Index: Specify the Index on your Splunk instance where the data will be stored. * Source: Define the source of the data. * Source Type: Specify the source type of the data. * OpenTelemetry Signal: Select how the telemetry data will be sent to the target.

4. Under Test Data Configuration, configure what data is streamed by selecting tests and tags associated with your current account group:

   • Cloud and Enterprise Agent Tests: Select Cloud and Enterprise Agent test data available in your account group to stream to the target.

   • Endpoint Agent Tests: Select Endpoint Agent test data from your account group to stream to the target.

   • Tags: Select tags from your current account group to associate with the integration. Data from Cloud and Enterprise Agent tests and Endpoint tests tagged with the same tags you select in this dropdown will be streamed to the configured target.

Creating a ThousandEyes for OpenTelemetry to Splunk Enterprise operation

Step 5: (Optional) Test Communication with the Target

You can test the connection to your target to ensure it is configured correctly.

1. Run the test:

   • Click Test at the bottom of the configuration form.

   • A test message will be sent to the target to verify the connection.

2. Review the test results:

   • If the test is successful:

     • A success message will be displayed.

       

       Test Success Message

• If the test fails:

  • An error message will be displayed with details about the failure.

    

    Test Failure Message

Step 6: Save the Operation

After completing the form, click Save to complete the creation of the integration. The operation will now be visible in the list view (Operations tab).

List Your Integrations

The Integrations 2.0 page displays all types of integrations in a unified list view. Connectors and Operations are listed separately.

Connectors

• Search and Sort: Use the search bar to find connectors by name, type, or target. Sort the list by clicking on the column headers.

• Table Columns:

  • Connector Name: The name of the connector.

  • Type: The type of the connector.

  • URL: The URL of the target of the connector.

  • Assigned Operations: The list of operations assigned to the connector.

• Actions: On the right side of each connector row, click the menu icon to access additional options to Edit, Manage Operations and Delete connectors.

Connectors List

Operations

• Search and Sort: Use the search bar to find operations by name, type, or target. Sort the list by clicking on the column headers.

• Table Columns:

  • Operation Name: The name of the operation.

  • Enabled: Indicates whether the operation is enabled.

  • Status: The status of the operation.

    • Connected: Indicates that the integration is enabled.

    • Pending: Indicates that the integration is disabled.

  • Type: The type of the operation.

  • Connector Name: The name of the connector associated with the operation.

• Actions: On the right side of each connector row, click the menu icon to access additional options to Edit, Assign Connector and Delete operations.

Operations List

Delete an Integration

To completely remove an integration, delete both the connector and the operation associated with it.

To delete an operation or connector, select the Delete option from the menu on the right of the operation or connector entry.

Caution: If you delete a connector with an operation already associated with it, that operation will no longer work until a new connector is associated with it.

Edit an Integration

Edit a Connector

To edit a connector:

1. Click on the connector row or select Edit from the menu.

2. Modify the editable fields, which include:

   • Name

   • Target

   • Auth Type

   • Token

3. Click Save to apply the changes.

Note: For Splunk operations to function correctly, the Auth Type must be set to Other Token, and it must include a valid Splunk HEC token.

Edit an Operation

To edit an operation:

1. Click on the operation row or select Edit from the menu.

2. Modify the editable fields, which include:

   • Operation Name

   • Index

   • Source

   • Source Type

   • Operation Status

   • Cloud and Enterprise Agent Tests

   • Endpoint Agent Tests

   • Tags

3. Click Save to apply the changes.