# Cisco ThousandEyes App for Splunk

The Cisco ThousandEyes App for Splunk enables organizations to collect, map, and visualize data from Cisco ThousandEyes within Splunk. It supports monitoring, troubleshooting, and optimizing digital experiences by integrating Cisco ThousandEyes' powerful insights into Splunk dashboards. The app leverages ThousandEyes OpenTelemetry (OTel) streams, APIs, and Splunk’s Common Information Model (CIM) to deliver actionable intelligence through customizable visualizations.

The Cisco ThousandEyes App for Splunk provides the following features:

* **Data Collection**: Collect test stream metrics, path visualization data, events, and activity logs from Cisco ThousandEyes OTel streams and APIs, and store them in Splunk indexes.
* **Data Mapping**: Map collected data to the Splunk Common Information Model (CIM) for consistency and usability.
* **Data Visualization**: Visualize metrics, events and logs using interactive dashboards with charts and tables.

## Compatibility Matrix

| **Category**                   | **Supported Versions**                                         |
| ------------------------------ | -------------------------------------------------------------- |
| **Browsers**                   | Google Chrome, Mozilla Firefox                                 |
| **Operating systems**          | Linux, Windows                                                 |
| **Splunk Enterprise versions** | `9.4.x`, `9.3.x`, `9.2.x`, `9.1.x`                             |
| **Splunk CIM version**         | `6.0.1`                                                        |
| **Supported deployments**      | Splunk Cloud, Splunk Standalone, Splunk Distributed Deployment |
| **Supported experience**       | `Victoria`                                                     |

## System Requirements

The Cisco ThousandEyes App for Splunk integration requires a Splunk deployment meeting Splunk's basic hardware and software requirements. For details, see the [Splunk system requirements](https://docs.splunk.com/Documentation/Splunk/8.2.4/Capacity/Referencehardware).

## Install the Cisco ThousandEyes App for Splunk

The installation steps depend on your Splunk deployment type:

* [Standalone Splunk Deployment](https://docs.splunk.com/Documentation/AddOns/released/Overview/Singleserverinstall)
* [Distributed Splunk Deployment](https://docs.splunk.com/Documentation/AddOns/released/Overview/Distributedinstall)
* [Splunk Cloud Deployment](https://docs.splunk.com/Documentation/AddOns/latest/Overview/SplunkCloudinstall)

For distributed setups, ensure the app is installed at the following locations:

| **Splunk Instance Type**        | **Is Installation Required?** |
| ------------------------------- | ----------------------------- |
| Heavy Forwarder                 | Yes                           |
| Indexer/Indexer Cluster         | No                            |
| Search Head/Search Head Cluster | Yes                           |

You can install the Cisco ThousandEyes App for Splunk using one of the following methods:

### Install from the Splunk Web UI

1. Navigate to **Apps > Manage Apps > Browse more apps**.
2. Search for **Cisco ThousandEyes App for Splunk**.
3. Select the app and click **Install**.

**Note**: The Splunk host must have an active internet connection for this method.

### Download and Install from the Splunk Web UI

1. Download [Cisco ThousandEyes App for Splunk](https://splunkbase.splunk.com/app/7719) from Splunkbase.
2. Navigate to **Apps > Manage Apps > Install app from file**.
3. Upload the downloaded file.

### Manually Install the Cisco ThousandEyes App for Splunk

1. Download [Cisco ThousandEyes App for Splunk](https://splunkbase.splunk.com/app/7719) from Splunkbase.
2. Extract the compressed file into the `$SPLUNK_HOME/etc/apps` folder.

**Note**: `$SPLUNK_HOME` is the environment variable that specifies the Splunk installation path.

After installation, restart Splunk if prompted.

## Upgrade the Cisco ThousandEyes App for Splunk

You can upgrade the Cisco ThousandEyes App for Splunk using one of the following methods.

### Upgrade from Splunk Web UI (Manual Installation)

1. Download the required version from [Cisco ThousandEyes App for Splunk on Splunkbase](https://splunkbase.splunk.com/app/7719).
2. In Splunk, go to **Apps** > **Manage Apps**.
3. Click **Install app from file**.
4. Click **Choose File** and select the Cisco ThousandEyes App for Splunk installation file.
5. Select **Upgrade app**, then click **Upload**.
6. Restart the Splunk instance if prompted.

### Upgrade from Splunk Web UI (Automated Update)

1. In Splunk, go to **Apps** > **Manage Apps**.
2. Find **Cisco ThousandEyes App for Splunk** in the list.
3. In the **Version** column, click **Update to `<latest_version>`**.
4. Accept the terms and conditions, then click **Accept and continue**.
5. Enter your credentials if prompted.
6. Restart the Splunk instance if prompted.