# Configuration

Users can configure the Cisco ThousandEyes App for Splunk through the Splunk Web User Interface (UI). Configuration pages are accessible only to users with the `admin_all_objects` or `sc_admin_all_objects` permission. By default, users with the `admin` or `sc_admin` role in Splunk have these permissions.

These configurations are used for data collection and data model setup, which populates the app's dashboards.

## Required ThousandEyes User Permissions

To successfully authenticate and collect data using the ThousandEyes app for Splunk, ThousandEyes users must have the following permissions assigned.

| Permission                                       | Description                                                                                                        |
| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------ |
| API access                                       | Allows you to perform all ThousandEyes API interactions required by the app.                                       |
| Edit connectors and operations                   | Allows you to create and edit connectors and operations.                                                           |
| Edit streaming integrations                      | Allows you to configure and manage Splunk streaming integrations, including enabling and modifying the connection. |
| Edit alert rules                                 | Allows you to associate the webhook operation with alert rules for the Stream Alert input.                         |
| Login via ThousandEyes login page                | Allows you to log in interactively using your ThousandEyes username and password.                                  |
| View all users                                   | Allows you to set up OAuth 2.0 authentication.                                                                     |
| View activity log for all users in account group | Allows you to view and collect activity events for all users within the assigned account group.                    |
| View connectors and operations                   | Allows you to view connectors and operations.                                                                      |
| View endpoint experience tests                   | Allows you to view endpoint experience tests.                                                                      |
| View labels                                      | Allows you to view labels used to organize and categorize tests and resources.                                     |
| View own activity log                            | Allows you to view and collect your own activity events.                                                           |
| View tests                                       | Allows you to view test configurations and collect both Events Stream and Tests Stream data.                       |
| View user activity in all account groups         | Allows you to view and collect activity events across all account groups in the organization.                      |
| View alert rules                                 | Allows you to list alert rules for the Stream Alert input.                                                         |

For more information on ThousandEyes user permissions, see [Built-In Roles and Permissions](https://docs.thousandeyes.com/product-documentation/user-management/authorization/rb-access-control/built-in-roles-and-permissions).

## Configure ThousandEyes Users

### Add a ThousandEyes User

1. Go to **Cisco ThousandEyes App for Splunk > Configuration > ThousandEyes User**.
2. Click **Add** in the top-right corner.
3. In the pop-up form, confirm that the **User Code** and **Verification URL** are auto-filled. The **Authorize** button will also appear.
4. Click **Authorize**. In the pop-up window:
   * Verify the user code.
   * Sign in with your credentials.
   * Provide consent.
   * Wait for the window to close or close it manually.
5. After the pop-up closes, the app detects the authorized user’s email and generates the tokens.
6. When the **Add** button becomes available, click it to save the user.

After adding a user, the list of all configured ThousandEyes users is visible under the **Configuration > ThousandEyes User** tab.

**Note**: The access token refreshes automatically every week and does not expire.

### Re-Authorize a ThousandEyes User

1. Go to **Cisco ThousandEyes App for Splunk > Configuration > ThousandEyes User**.
2. In the **Actions** column, click **Edit** for the user.
3. Click **Re-Authorize**. In the pop-up window:
   * Verify the user code.
   * Sign in with your credentials.
   * Provide consent.
   * Wait for the window to close or close it manually.
4. After the pop-up closes, the app detects the re-authorized user’s email and generates the tokens.
5. When the **Update** button becomes available, click it to update the account tokens.

### Remove an Account

To remove a user from the Cisco ThousandEyes App for Splunk:

1. Go to **Cisco ThousandEyes App for Splunk > Configuration > ThousandEyes User**.
2. Find the user you want to delete.
3. In the **Actions** column, click **Delete**.
4. Confirm the deletion in the pop-up window.

## Configure a ThousandEyes Free Trial

To configure the 15-day ThousandEyes free trial:

1. Go to **Configuration > ThousandEyes Free Trial**.
2. Complete the setup:
   * Submit the ThousandEyes free trial form.
   * Wait for the activation email.
   * Click the activation link and set your password.
   * Create a ThousandEyes test.
3. Click [**Start 15-day Free Trial**](https://www.thousandeyes.com/signup/) to begin.

**Note:** For more information on creating a ThousandEyes test, see [Getting Started with Cloud and Enterprise Agent Tests](https://docs.thousandeyes.com/product-documentation/getting-started/getting-started-with-cloud-and-enterprise-agent-tests).

## Configure Proxy Settings

To configure proxy settings for the app:

1. Go to **Cisco ThousandEyes App for Splunk > Configuration > Proxy**.
2. To enable or disable proxy use, check or uncheck the **Enable Proxy** box.
3. Enter the required proxy details as described below:

   | **Parameter**     | **Type** | **Required?**                 | **Description**                                               |
   | ----------------- | -------- | ----------------------------- | ------------------------------------------------------------- |
   | Enable            | Checkbox | No                            | Enables or disables proxy use.                                |
   | Auth Type         | Dropdown | Yes                           | Authentication type to use. Possible values: `None`, `Basic`. |
   | Proxy Username    | Textbox  | Yes (if Auth Type is `Basic`) | Username for the proxy server.                                |
   | Proxy Password    | Textbox  | Yes (if Auth Type is `Basic`) | Password for the proxy server.                                |
   | Proxy Protocol    | Dropdown | Yes                           | Proxy protocol to use. Only HTTP is supported.                |
   | Proxy Certificate | Textarea | No                            | SA certificate content in PEM format.                         |
   | Proxy Host        | Textbox  | Yes                           | Hostname or IP of the proxy server.                           |
   | Proxy Port        | Textbox  | Yes                           | Port number for the proxy server.                             |
4. Click **Save** to apply the changes.

## Configure Logging

To configure the logging level for the app:

1. Go to **Cisco ThousandEyes App for Splunk > Configuration > Logging**.
2. Select the desired logging level from the dropdown menu.
3. Click **Save**.

## Configure Data Model

The Cisco ThousandEyes App for Splunk includes a single data model: **Cisco ThousandEyes**. The app's dashboards use this data model to populate data through search queries.

Accelerated data models improve search query performance, which enhances dashboard performance. By default, acceleration for this data model is disabled. Users can enable or disable data model acceleration as needed.

### Enable or Disable Data Model Acceleration

To enable or disable acceleration for the Cisco ThousandEyes data model:

1. Go to **Settings > Data Models** from the Splunk menu bar.
2. Locate the **Cisco ThousandEyes Data Model** in the list.
3. In the **Action** column, click **Edit**.
4. From the list of actions, select **Edit Acceleration**. A pop-up will appear.
5. Do one of the following:
   * To enable acceleration: check the **Accelerate** box.
   * To disable acceleration: uncheck the **Accelerate** box.
6. If enabling acceleration, set the **Summary Range** to define the acceleration period.

   > **Recommended:** Use a 7-day summary range.
7. Click **Save** to apply the changes.

### Rebuild the Data Model

To rebuild the Cisco ThousandEyes data model for the specified acceleration period:

1. Go to **Settings > Data Models** from the Splunk menu bar.
2. Locate the **Cisco ThousandEyes Data Model** in the list.
3. Click the **>** arrow in the first column to expand the row and reveal the **Acceleration** section.
4. In the **Acceleration** section, click **Rebuild**.
5. Check the **Status** field to monitor the rebuild progress.
6. Reload the page to see the latest status.

## Configure Macros

The Cisco ThousandEyes App for Splunk includes the following macros:

| **Macro Name**   | **Description**                                                                                             | **Default Value**                            |
| ---------------- | ----------------------------------------------------------------------------------------------------------- | -------------------------------------------- |
| `summariesonly`  | Specifies whether only summarized data from the Cisco ThousandEyes data model is used in dashboard queries. | `false` (queries use raw, unsummarized data) |
| `stream_index`   | Specifies the indexes where Tests Stream Metrics data is collected.                                         | `index=*`                                    |
| `path_viz_index` | Specifies the indexes where Path Visualization data is collected.                                           | `index=*`                                    |
| `event_index`    | Specifies the indexes where Event data is collected.                                                        | `index=*`                                    |
| `activity_index` | Specifies the indexes where User Activity data is collected.                                                | `index=*`                                    |

**Note**: Update these index macros to specify the exact indexes where corresponding data is collected. Leaving the default value (`index=*`) may lead to performance overhead as unrelated indexes will also be searched.

### Update a Macro

To update a macro:

1. Go to **Settings > Advanced Search > Search Macro**.
2. In the **App** dropdown, select **Cisco ThousandEyes App for Splunk**.
3. Find the macro you want to update and click it to open the form.
4. In the form, update the **Definition** field as needed.
5. Click **Save** to apply your changes.