Configuration

Users can configure the Cisco ThousandEyes App for Splunk through the Splunk Web User Interface (UI). Configuration pages are accessible only to users with the admin_all_objects or sc_admin_all_objects permission. By default, users with the admin or sc_admin role in Splunk have these permissions.

These configurations are used for data collection and data model setup, which populates the app's dashboards.

ThousandEyes User Configuration

Add a ThousandEyes User

1. Navigate to Cisco ThousandEyes App for Splunk > Configuration > ThousandEyes User.

2. Click Add in the top-right corner.

3. In the pop-up form, the User Code and Verification URL will be auto-populated, and the Authorize button will be available.

4. Click Authorize. A pop-up window will open:

   • Verify the user code.

   • Log in with your credentials.

   • Provide consent.

   • Close the pop-up window or wait for it to close automatically.

5. The user's email used during authorization will be detected, and tokens will be generated when the pop-up closes.

6. Once the Add button becomes available, click it to save the user.

After adding a user, the list of all configured ThousandEyes users is visible under the Configuration > ThousandEyes User tab.

Remove an Account

1. Navigate to Cisco ThousandEyes App for Splunk > Configuration > ThousandEyes User.

2. Locate the user to delete from the list.

3. Click the Delete button in the Actions column.

4. Confirm the deletion in the pop-up window.

Proxy Configuration

To configure proxy settings for the app:

1. Navigate to Cisco ThousandEyes App for Splunk > Configuration > Proxy.

2. Check or uncheck the Enable Proxy checkbox to use or disable the proxy, respectively.

3. Enter the required details for:

   • Proxy Type

   • Host

   • Port

   • Username and Password (if applicable)

4. Click Save to apply the changes.

Logging Configuration

To configure the logging level for the app:

1. Navigate to Cisco ThousandEyes App for Splunk > Configuration > Logging.

2. Select the desired logging level from the dropdown menu.

3. Click Save.

Data Model Configuration

The Cisco ThousandEyes App for Splunk includes a single data model: Cisco ThousandEyes. The app's dashboards use this data model to populate data through search queries.

Accelerated data models improve search query performance, which enhances dashboard performance. By default, acceleration for this data model is disabled. Users can enable or disable data model acceleration as needed.

Enable or Disable Data Model Acceleration

To enable or disable acceleration for the Cisco ThousandEyes data model:

1. On the Splunk menu bar, navigate to Settings > Data Models.

2. Locate the Cisco ThousandEyes Data Model in the list.

3. In the Action column, click Edit.

4. From the list of actions, select Edit Acceleration. A pop-up menu will appear.

5. Perform the following actions based on your needs:

   • Check the Accelerate checkbox to enable data model acceleration.

   • Uncheck the Accelerate checkbox to disable data model acceleration.

6. If enabling acceleration:

   • Specify the summary range to determine the acceleration period.

     Recommendation: Use a summary range of 7 days.

7. Click Save to apply the changes.

Rebuild the Data Model

If you need to rebuild the data model from scratch for the specified acceleration period:

1. On the Splunk menu bar, navigate to Settings > Data Models.

2. Locate the Cisco ThousandEyes Data Model in the list.

3. Expand the row by clicking the > arrow in the first column. This reveals additional information in the Acceleration section.

4. In the Acceleration section, click the Rebuild link.

5. Monitor the rebuild status in the Status field of the Acceleration section.

6. Reload the page to view the latest rebuild status.

Configure Macros

The Cisco ThousandEyes App for Splunk includes the following macros:

Macro Name	Description	Default Value
summariesonly	Specifies whether only summarized data from the Cisco ThousandEyes data model is used in dashboard queries.	false (queries use raw, unsummarized data)
stream_index	Specifies the indexes where Tests Stream Metrics data is collected.	index=*
path_viz_index	Specifies the indexes where Path Visualization data is collected.	index=*
event_index	Specifies the indexes where Event data is collected.	index=*
activity_index	Specifies the indexes where User Activity data is collected.	index=*

Note: Update these index macros to specify the exact indexes where corresponding data is collected. Leaving the default value (index=*) may lead to performance overhead as unrelated indexes will also be searched.

Update a Macro

To update a macro:

1. Navigate to Settings > Advanced Search > Search Macro.

2. In the App dropdown filter, select Cisco ThousandEyes App for Splunk.

3. Locate the macro you want to update.

4. In the form that opens, update the Definition field as needed.

5. Click Save.