# Inputs
The app provides three input types for data collection:
* **Tests Stream - Metrics**: Collects test metrics using ThousandEyes OpenTelemetry (OTel) streams and Path Visualization data using the ThousandEyes API.
* **Tests Stream - Traces**: Collects network trace data from Cloud & Enterprise Agent page-load and web transactions tests.
* **Event**: Collects detected events from the Cisco ThousandEyes platform using the API.
* **Activity logs Stream**: Collects activity log data using the OpenTelemetry stream integration instead of traditional polling.
* **Alerts Stream**: Collects real-time alert notifications from ThousandEyes using the webhook integration.
## Prerequisites for Data Collection Inputs
* **HTTP Event Collector (HEC)** must be enabled.
* The HEC must be reachable from the ThousandEyes platform. For more information, see [URL Target Requirements](https://docs.thousandeyes.com/product-documentation/integration-guides/opentelemetry/url-target-requirements)
* SSL must be enabled for HEC.
* At least one HEC token must be configured and enabled.
* An events index must be created to store the data.
### Enable HTTP Event Collector and SSL
* **Splunk Cloud**: HEC and SSL are enabled by default.
* **Splunk Enterprise**:
1. Go to **Settings > Data inputs > HTTP Event Collector**.
2. Click **Global settings**.
3. Enable **All Tokens**.
4. Check **Enable SSL** if it is not already enabled.
**Note**: Ensure the Splunk HEC certificates are valid and not self-signed.
### Configure the HTTP Event Collector Token
1. Go to **Settings > Data inputs > HTTP Event Collector**.
2. Click **New Token**.
3. Enter a **Name** and configure optional settings as needed. Click **Next**.
4. Select **Allowed Indexes** and update the **Default Index** if required.
5. Click **Review**, then click **Submit**.
### Enable the HTTP Event Collector Token
1. Go to **Settings > Data inputs > HTTP Event Collector**.
2. In the **Actions** column, click **Enable** for the token if it is not already active.
## Add an Input
1. Navigate to **Cisco ThousandEyes App for Splunk > Inputs**.
2. Click **Create New Input**.
3. Select the input type from the dropdown menu.
4. Fill in the required parameters for the selected input configuration.
5. Click **Add Input**.
## Input Parameters
### Tests Stream - Metrics
| **Parameter** | **Type** | **Required?** | **Description** |
| ----------------------------- | --------------------- | ------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Name | Textbox | Yes | Unique name for the input |
| ThousandEyes User | Dropdown | Yes | Select a user created in ThousandEyes User configuration |
| Account Group | Dropdown | Yes | Account group for data collection |
| Tags | Multi-valued Dropdown | No | Select tags for easier test selection |
| Cloud & Enterprise Agent Test | Multi-valued Dropdown | No | Select Cloud and Enterprise Agent tests to collect metrics |
| Endpoint Agent Test | Multi-valued Dropdown | No | Select Endpoint Agent tests to collect metrics |
| HEC Target | Textbox/Dropdown | Yes | Splunk HTTP Event Collector (HEC) target URL for the stream. Examples:
- Splunk Cloud Platform:
[https://http-inputs-\<host>.splunkcloud.com:443/services/collector/event](https://http-inputs-\<host>.splunkcloud.com:443/services/collector/event) - Splunk Enterprise:
https\://\:8088/services/collector/event
|
| HEC Token | Dropdown | Yes | Splunk HEC token for stream data |
| Test Index | Dropdown | Yes | Index used to store test metric data. It must be an events index. |
| Include Network Path Data | Checkbox | No | Enables collection of Path Visualization data |
| Path Index | Dropdown | Yes (if Network Path Data is enabled) | Index used to store Path Visualization data. It must be an events index. |
| Path Interval | Textbox | Yes (if Network Path Data is enabled) | Fetch interval for Path Visualization data |
### Tests Stream - Traces
| **Parameter** | **Type** | **Required?** | **Description** |
| ----------------------------- | --------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Name | Textbox | Yes | Unique name for the input |
| ThousandEyes User | Dropdown | Yes | Select a user created in ThousandEyes user configuration |
| Account Group | Dropdown | Yes | Account group for data collection |
| Tags | Multi-valued Dropdown | No | Select tags for easier test selection |
| Cloud & Enterprise Agent Test | Multi-valued Dropdown | No | Select Cloud and Enterprise Agent tests to collect metrics |
| HEC Target | Textbox/Dropdown | Yes | Splunk HTTP Event Collector (HEC) target URL for the stream. Examples:
- Splunk Cloud Platform:
[https://http-inputs-\<host>.splunkcloud.com:443/services/collector/event](https://http-inputs-\<host>.splunkcloud.com:443/services/collector/event) - Splunk Enterprise:
https\://\:8088/services/collector/event
|
| HEC Token | Dropdown | Yes | Splunk HEC token for stream data |
| Test Index | Dropdown | Yes | Index used to store test metric data. It must be an events index. |
### Event Input
| **Parameter** | **Type** | **Required?** | **Description** |
| ----------------- | -------- | ------------- | ----------------------------------------------------------- |
| Name | Textbox | Yes | Unique name for the input |
| ThousandEyes User | Dropdown | Yes | Select a user created in ThousandEyes User configuration |
| Account Group | Dropdown | Yes | Account group for data collection |
| Index | Dropdown | Yes | Index used to store event data. It must be an events index. |
| Interval | Dropdown | Yes | Fetch interval for event data |
### Activity Logs Stream Input
| **Parameter** | **Type** | **Required?** | **Description** |
| ------------------- | -------- | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Name | Textbox | Yes | Unique name for the input |
| ThousandEyes user | Dropdown | Yes | User created in the ThousandEyes user configuration |
| Account group | Dropdown | Yes | Account group used for data collection, or **All** to collect from all groups |
| HEC target | Textbox | Yes | URL for the Splunk HTTP Event Collector (HEC).
Example: Splunk Cloud – [https://http-inputs-\<host>.splunkcloud.com:443/services/collector/event](https://http-inputs-\<host>.splunkcloud.com:443/services/collector/event); Splunk Enterprise – https\://\:8088/services/collector/event
|
| HEC token | Dropdown | Yes | Token value of the configured Splunk HEC input |
| Activity logs index | Dropdown | Yes | Index used to store activity log data. It must be an events index. |
### Alerts Stream Input
| **Parameter** | **Type** | **Required?** | **Description** |
| ----------------- | -------- | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Name | Textbox | Yes | Unique name for the input |
| ThousandEyes User | Dropdown | Yes | Select the user created from the configuration step |
| Account Group | Dropdown | Yes | Select one account group |
| Alert Rules | Dropdown | Yes | Select one/multiple alert rules to enable webhook notifications |
| HEC Target | Dropdown | Yes | HEC target URL (e.g., `https://http-inputs-.splunkcloud.com:443/services/collector/event` for Splunk Cloud or `https://:8088/services/collector/event` for Splunk Enterprise) |
| HEC Token | Dropdown | Yes | Token value of the configured Splunk HEC input |
| Alerts Index | Dropdown | Yes | Index used to store alerts data. It must be an events index. |
**Note**: When you configure an Alerts Stream input, the system will automatically:
* Create a webhook operation in ThousandEyes
* Create a connector for Splunk HEC integration
* Link the webhook operation to the connector
* Update the selected alert rules to use the webhook for notifications
## Manage Inputs
### Disable an Input
1. Go to **Cisco ThousandEyes App for Splunk > Inputs**.
2. Find the input you want to disable.
3. In the **Actions** column, click **Disable**.
### Enable an Input
1. Go to **Cisco ThousandEyes App for Splunk > Inputs**.
2. Find the input you want to enable.
3. In the **Actions** column, click **Enable**.
### Edit an Input
1. Go to **Cisco ThousandEyes App for Splunk > Inputs**.
2. Find the input you want to edit.
3. In the **Actions** column, click **Edit**.
4. Update the fields as needed.
5. Click **Update** to save your changes.
### Clone an Input
1. Go to **Cisco ThousandEyes App for Splunk > Inputs**.
2. Find the input you want to clone.
3. In the **Actions** column, click **Clone**.
4. Update the fields as needed.
5. Click **Save** to create the cloned input.
### Delete an Input
1. Go to **Cisco ThousandEyes App for Splunk > Inputs**.
2. Find the input you want to delete.
3. In the **Actions** column, click **Delete**.
4. Confirm the deletion in the pop-up window.