Configuration
Users can configure the Cisco ThousandEyes App for Splunk through the Splunk Web User Interface (UI). Configuration pages are accessible only to users with the admin_all_objects or sc_admin_all_objects permission. By default, users with the admin or sc_admin role in Splunk have these permissions.
These configurations are used for data collection and data model setup, which populates the app's dashboards.
Configure ThousandEyes Users
Add a ThousandEyes User
Go to Cisco ThousandEyes App for Splunk > Configuration > ThousandEyes User.
Click Add in the top-right corner.
In the pop-up form, confirm that the User Code and Verification URL are auto-filled. The Authorize button will also appear.
Click Authorize. In the pop-up window:
Verify the user code.
Sign in with your credentials.
Provide consent.
Wait for the window to close or close it manually.
After the pop-up closes, the app detects the authorized user’s email and generates the tokens.
When the Add button becomes available, click it to save the user.
After adding a user, the list of all configured ThousandEyes users is visible under the Configuration > ThousandEyes User tab.
Note: The access token refreshes automatically every week and does not expire.
Re-Authorize a ThousandEyes User
Go to Cisco ThousandEyes App for Splunk > Configuration > ThousandEyes User.
In the Actions column, click Edit for the user.
Click Re-Authorize. In the pop-up window:
Verify the user code.
Sign in with your credentials.
Provide consent.
Wait for the window to close or close it manually.
After the pop-up closes, the app detects the re-authorized user’s email and generates the tokens.
When the Update button becomes available, click it to update the account tokens.
Remove an Account
To remove a user from the Cisco ThousandEyes App for Splunk:
Go to Cisco ThousandEyes App for Splunk > Configuration > ThousandEyes User.
Find the user you want to delete.
In the Actions column, click Delete.
Confirm the deletion in the pop-up window.
Configure a ThousandEyes Free Trial
To configure the 15-day ThousandEyes free trial:
Go to Configuration > ThousandEyes Free Trial.
Complete the setup:
Submit the ThousandEyes free trial form.
Wait for the activation email.
Click the activation link and set your password.
Create a ThousandEyes test.
Click Start 15-day Free Trial to begin.
Note: For more information on creating a ThousandEyes test, see Getting Started with Cloud and Enterprise Agent Tests.
Configure Proxy Settings
To configure proxy settings for the app:
Go to Cisco ThousandEyes App for Splunk > Configuration > Proxy.
To enable or disable proxy use, check or uncheck the Enable Proxy box.
Enter the required proxy details as described below:
Parameter
Type
Required?
Description
Enable
Checkbox
No
Enables or disables proxy use.
Auth Type
Dropdown
Yes
Authentication type to use. Possible values:
None,Basic.Proxy Username
Textbox
Yes (if Auth Type is
Basic)Username for the proxy server.
Proxy Password
Textbox
Yes (if Auth Type is
Basic)Password for the proxy server.
Proxy Protocol
Dropdown
Yes
Proxy protocol to use. Only HTTP is supported.
Proxy Certificate
Textarea
No
SA certificate content in PEM format.
Proxy Host
Textbox
Yes
Hostname or IP of the proxy server.
Proxy Port
Textbox
Yes
Port number for the proxy server.
Click Save to apply the changes.
Configure Logging
To configure the logging level for the app:
Go to Cisco ThousandEyes App for Splunk > Configuration > Logging.
Select the desired logging level from the dropdown menu.
Click Save.
Configure Data Model
The Cisco ThousandEyes App for Splunk includes a single data model: Cisco ThousandEyes. The app's dashboards use this data model to populate data through search queries.
Accelerated data models improve search query performance, which enhances dashboard performance. By default, acceleration for this data model is disabled. Users can enable or disable data model acceleration as needed.
Enable or Disable Data Model Acceleration
To enable or disable acceleration for the Cisco ThousandEyes data model:
Go to Settings > Data Models from the Splunk menu bar.
Locate the Cisco ThousandEyes Data Model in the list.
In the Action column, click Edit.
From the list of actions, select Edit Acceleration. A pop-up will appear.
Do one of the following:
To enable acceleration: check the Accelerate box.
To disable acceleration: uncheck the Accelerate box.
If enabling acceleration, set the Summary Range to define the acceleration period.
Recommended: Use a 7-day summary range.
Click Save to apply the changes.
Rebuild the Data Model
To rebuild the Cisco ThousandEyes data model for the specified acceleration period:
Go to Settings > Data Models from the Splunk menu bar.
Locate the Cisco ThousandEyes Data Model in the list.
Click the > arrow in the first column to expand the row and reveal the Acceleration section.
In the Acceleration section, click Rebuild.
Check the Status field to monitor the rebuild progress.
Reload the page to see the latest status.
Configure Macros
The Cisco ThousandEyes App for Splunk includes the following macros:
Macro Name
Description
Default Value
summariesonly
Specifies whether only summarized data from the Cisco ThousandEyes data model is used in dashboard queries.
false (queries use raw, unsummarized data)
stream_index
Specifies the indexes where Tests Stream Metrics data is collected.
index=*
path_viz_index
Specifies the indexes where Path Visualization data is collected.
index=*
event_index
Specifies the indexes where Event data is collected.
index=*
activity_index
Specifies the indexes where User Activity data is collected.
index=*
Note: Update these index macros to specify the exact indexes where corresponding data is collected. Leaving the default value (index=*) may lead to performance overhead as unrelated indexes will also be searched.
Update a Macro
To update a macro:
Go to Settings > Advanced Search > Search Macro.
In the App dropdown, select Cisco ThousandEyes App for Splunk.
Find the macro you want to update and click it to open the form.
In the form, update the Definition field as needed.
Click Save to apply your changes.
Last updated