# Inputs
The app provides three input types for data collection:
* **Tests Stream - Metrics**: Collects test metrics using ThousandEyes OpenTelemetry (OTel) streams and Path Visualization data using the ThousandEyes API.
* **Tests Stream - Traces**: Collects network trace data from Cloud & Enterprise Agent page-load and web transactions tests.
* **Event**: Collects detected events from the Cisco ThousandEyes platform using the API.
* **Activity logs Stream**: Collects activity log data using the OpenTelemetry stream integration instead of traditional polling.
* **Alerts Stream**: Collects real-time alert notifications from ThousandEyes using the webhook integration.
## Prerequisites for Data Collection Inputs
* **HTTP Event Collector (HEC)** must be enabled.
* The HEC must be reachable from the ThousandEyes platform. For more information, see [URL Target Requirements](https://docs.thousandeyes.com/product-documentation/integration-guides/opentelemetry/url-target-requirements)
* SSL must be enabled for HEC.
* At least one HEC token must be configured and enabled.
* An events index must be created to store the data.
### Enable HTTP Event Collector and SSL
* **Splunk Cloud**: HEC and SSL are enabled by default.
* **Splunk Enterprise**:
1. Go to **Settings > Data inputs > HTTP Event Collector**.
2. Click **Global settings**.
3. Enable **All Tokens**.
4. Check **Enable SSL** if it is not already enabled.
**Note**: Ensure the Splunk HEC certificates are valid and not self-signed.
### Configure the HTTP Event Collector Token
1. Go to **Settings > Data inputs > HTTP Event Collector**.
2. Click **New Token**.
3. Enter a **Name** and configure optional settings as needed. Click **Next**.
4. Select **Allowed Indexes** and update the **Default Index** if required.
5. Click **Review**, then click **Submit**.
### Enable the HTTP Event Collector Token
1. Go to **Settings > Data inputs > HTTP Event Collector**.
2. In the **Actions** column, click **Enable** for the token if it is not already active.
## Add an Input
1. Navigate to **Cisco ThousandEyes App for Splunk > Inputs**.
2. Click **Create New Input**.
3. Select the input type from the dropdown menu.
4. Fill in the required parameters for the selected input configuration.
5. Click **Add Input**.
## Input Parameters
### Tests Stream - Metrics
| **Parameter** | **Type** | **Required?** | **Description** |
| ----------------------------- | --------------------- | ------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Name | Textbox | Yes | Unique name for the input |
| ThousandEyes User | Dropdown | Yes | Select a user created in ThousandEyes User configuration |
| Account Group | Dropdown | Yes | Account group for data collection |
| Tags | Multi-valued Dropdown | No | Select tags for easier test selection |
| Cloud & Enterprise Agent Test | Multi-valued Dropdown | No | Select Cloud and Enterprise Agent tests to collect metrics |
| Endpoint Agent Test | Multi-valued Dropdown | No | Select Endpoint Agent tests to collect metrics |
| HEC Target | Textbox/Dropdown | Yes | Splunk HTTP Event Collector (HEC) target URL for the stream. Examples:
- Splunk Cloud Platform:
[https://http-inputs-\<host>.splunkcloud.com:443/services/collector/event](https://http-inputs-\<host>.splunkcloud.com:443/services/collector/event) - Splunk Enterprise:
https\://\:8088/services/collector/event
|
| HEC Token | Dropdown | Yes | Splunk HEC token for stream data |
| Test Index | Dropdown | Yes | Index used to store test metric data. It must be an events index. |
| Include Network Path Data | Checkbox | No | Enables collection of Path Visualization data |
| Path Index | Dropdown | Yes (if Network Path Data is enabled) | Index used to store Path Visualization data. It must be an events index. |
| Path Interval | Textbox | Yes (if Network Path Data is enabled) | Fetch interval for Path Visualization data |
### Tests Stream - Traces
| **Parameter** | **Type** | **Required?** | **Description** |
| ----------------------------- | --------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Name | Textbox | Yes | Unique name for the input |
| ThousandEyes User | Dropdown | Yes | Select a user created in ThousandEyes user configuration |
| Account Group | Dropdown | Yes | Account group for data collection |
| Tags | Multi-valued Dropdown | No | Select tags for easier test selection |
| Cloud & Enterprise Agent Test | Multi-valued Dropdown | No | Select Cloud and Enterprise Agent tests to collect metrics |
| HEC Target | Textbox/Dropdown | Yes | Splunk HTTP Event Collector (HEC) target URL for the stream. Examples:
- Splunk Cloud Platform:
[https://http-inputs-\<host>.splunkcloud.com:443/services/collector/event](https://http-inputs-\<host>.splunkcloud.com:443/services/collector/event) - Splunk Enterprise:
https\://\:8088/services/collector/event
|
| HEC Token | Dropdown | Yes | Splunk HEC token for stream data |
| Test Index | Dropdown | Yes | Index used to store test metric data. It must be an events index. |
### Event Input
| **Parameter** | **Type** | **Required?** | **Description** |
| ----------------- | -------- | ------------- | ----------------------------------------------------------- |
| Name | Textbox | Yes | Unique name for the input |
| ThousandEyes User | Dropdown | Yes | Select a user created in ThousandEyes User configuration |
| Account Group | Dropdown | Yes | Account group for data collection |
| Index | Dropdown | Yes | Index used to store event data. It must be an events index. |
| Interval | Dropdown | Yes | Fetch interval for event data |
### Activity Logs Stream Input
| **Parameter** | **Type** | **Required?** | **Description** |
| ------------------- | -------- | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Name | Textbox | Yes | Unique name for the input |
| ThousandEyes user | Dropdown | Yes | User created in the ThousandEyes user configuration |
| Account group | Dropdown | Yes | Account group used for data collection, or **All** to collect from all groups |
| HEC target | Textbox | Yes | URL for the Splunk HTTP Event Collector (HEC).
Example: Splunk Cloud – [https://http-inputs-\<host>.splunkcloud.com:443/services/collector/event](https://http-inputs-\<host>.splunkcloud.com:443/services/collector/event); Splunk Enterprise – https\://\:8088/services/collector/event
|
| HEC token | Dropdown | Yes | Token value of the configured Splunk HEC input |
| Activity logs index | Dropdown | Yes | Index used to store activity log data. It must be an events index. |
### Alerts Stream Input
| **Parameter** | **Type** | **Required?** | **Description** |
| ----------------- | -------- | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Name | Textbox | Yes | Unique name for the input |
| ThousandEyes User | Dropdown | Yes | Select the user created from the configuration step |
| Account Group | Dropdown | Yes | Select one account group |
| Alert Rules | Dropdown | Yes | Select one/multiple alert rules to enable webhook notifications |
| HEC Target | Dropdown | Yes | HEC target URL (e.g., `https://http-inputs-.splunkcloud.com:443/services/collector/event` for Splunk Cloud or `https://:8088/services/collector/event` for Splunk Enterprise) |
| HEC Token | Dropdown | Yes | Token value of the configured Splunk HEC input |
| Alerts Index | Dropdown | Yes | Index used to store alerts data. It must be an events index. |
**Note**: When you configure an Alerts Stream input, the system will automatically:
* Create a webhook operation in ThousandEyes
* Create a connector for Splunk HEC integration
* Link the webhook operation to the connector
* Update the selected alert rules to use the webhook for notifications
## Manage Inputs
### Disable an Input
1. Go to **Cisco ThousandEyes App for Splunk > Inputs**.
2. Find the input you want to disable.
3. In the **Actions** column, click **Disable**.
### Enable an Input
1. Go to **Cisco ThousandEyes App for Splunk > Inputs**.
2. Find the input you want to enable.
3. In the **Actions** column, click **Enable**.
### Edit an Input
1. Go to **Cisco ThousandEyes App for Splunk > Inputs**.
2. Find the input you want to edit.
3. In the **Actions** column, click **Edit**.
4. Update the fields as needed.
5. Click **Update** to save your changes.
### Clone an Input
1. Go to **Cisco ThousandEyes App for Splunk > Inputs**.
2. Find the input you want to clone.
3. In the **Actions** column, click **Clone**.
4. Update the fields as needed.
5. Click **Save** to create the cloned input.
### Delete an Input
1. Go to **Cisco ThousandEyes App for Splunk > Inputs**.
2. Find the input you want to delete.
3. In the **Actions** column, click **Delete**.
4. Confirm the deletion in the pop-up window.
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://docs.thousandeyes.com/product-documentation/integration-guides/custom-built-integrations/splunk-app/inputs.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.