Cisco ThousandEyes App for Splunk

The Cisco ThousandEyes App for Splunk enables organizations to collect, map, and visualize data from Cisco ThousandEyes within Splunk. It supports monitoring, troubleshooting, and optimizing digital experiences by integrating Cisco ThousandEyes' powerful insights into Splunk dashboards. The app leverages ThousandEyes OpenTelemetry (OTel) streams, APIs, and Splunk’s Common Information Model (CIM) to deliver actionable intelligence through customizable visualizations.

The Cisco ThousandEyes App for Splunk provides the following features:

• Data Collection: Collect test stream metrics, path visualization data, events, and activity logs from Cisco ThousandEyes OTel streams and APIs, and store them in Splunk indexes.

• Data Mapping: Map collected data to the Splunk Common Information Model (CIM) for consistency and usability.

• Data Visualization: Visualize metrics, events and logs using interactive dashboards with charts and tables.

Compatibility Matrix

Category	Supported Versions
Browsers	Google Chrome, Mozilla Firefox
Operating Systems	Linux, Windows
Splunk Enterprise Versions	9.4.x, 9.3.x, 9.2.x, 9.1.x
Splunk CIM Version	6.0.1
Supported Deployments	Splunk Cloud, Splunk Standalone, Splunk Distributed Deployment

System Requirements

The Cisco ThousandEyes App for Splunk integration requires a Splunk deployment meeting Splunk's basic hardware and software requirements. For details, see the Splunk system requirements.

Install the Cisco ThousandEyes App for Splunk

The installation steps depend on your Splunk deployment type:

• Standalone Splunk Deployment

• Distributed Splunk Deployment

• Splunk Cloud Deployment

For distributed setups, ensure the app is installed at the following locations:

Splunk Instance Type	Is Installation Required?
Heavy Forwarder	Yes
Indexer/Indexer Cluster	No
Search Head/Search Head Cluster	Yes

You can install the Cisco ThousandEyes App for Splunk using one of the following methods:

Install from the Splunk Web UI

1. Navigate to Apps > Manage Apps > Browse more apps.

2. Search for Cisco ThousandEyes App for Splunk.

3. Select the app and click Install.

Note: The Splunk host must have an active internet connection for this method.

Download and Install from the Splunk Web UI

1. Download Cisco ThousandEyes App for Splunk from Splunkbase.

2. Navigate to Apps > Manage Apps > Install app from file.

3. Upload the downloaded file.

Manually Install the Cisco ThousandEyes App for Splunk

1. Download Cisco ThousandEyes App for Splunk from Splunkbase.

2. Extract the compressed file into the $SPLUNK_HOME/etc/apps folder.

Note: $SPLUNK_HOME is the environment variable that specifies the Splunk installation path.

After installation, restart Splunk if prompted.

Upgrade the Cisco ThousandEyes App for Splunk

You can upgrade the Cisco ThousandEyes App for Splunk using one of the following methods.

Upgrade from Splunk Web UI (Manual Installation)

1. Download the required version from Cisco ThousandEyes App for Splunk on Splunkbase.

2. In Splunk, go to Apps > Manage Apps.

3. Click Install app from file.

4. Click Choose File and select the Cisco ThousandEyes App for Splunk installation file.

5. Select Upgrade app, then click Upload.

6. Restart the Splunk instance if prompted.

Upgrade from Splunk Web UI (Automated Update)

1. In Splunk, go to Apps > Manage Apps.

2. Find Cisco ThousandEyes App for Splunk in the list.

3. In the Version column, click Update to <latest_version>.

4. Accept the terms and conditions, then click Accept and continue.

5. Enter your credentials if prompted.

6. Restart the Splunk instance if prompted.