Inputs

The app provides three input types for data collection:

• Tests Stream - Metrics: Collects test metrics using ThousandEyes OpenTelemetry (OTel) streams and Path Visualization data using the ThousandEyes API.

• Tests Stream - Traces: Collects network trace data from Cloud & Enterprise Agent page-load and web transactions tests.

• Event: Collects detected events from the Cisco ThousandEyes platform using the API.

• Activity logs Stream: Collects activity log data using the OpenTelemetry stream integration instead of traditional polling.

• Alerts Stream: Collects real-time alert notifications from ThousandEyes using the webhook integration.

Prerequisites for Tests Stream Inputs

• HTTP Event Collector (HEC) must be enabled.

• The HEC must be reachable from the ThousandEyes platform. For more information, see URL Target Requirements

• SSL must be enabled for HEC.

• At least one HEC token should be configured and enabled.

Enable HTTP Event Collector and SSL

• Splunk Cloud: HEC and SSL are enabled by default.

• Splunk Enterprise:

  1. Go to Settings > Data inputs > HTTP Event Collector.

  2. Click Global settings.

  3. Enable All Tokens.

  4. Check Enable SSL if it is not already enabled.

Note: Ensure the Splunk HEC certificates are valid and not self-signed.

Configure the HTTP Event Collector Token

1. Go to Settings > Data inputs > HTTP Event Collector.

2. Click New Token.

3. Enter a Name and configure optional settings as needed. Click Next.

4. Select Allowed Indexes and update the Default Index if required.

5. Click Review, then click Submit.

Enable the HTTP Event Collector Token

1. Go to Settings > Data inputs > HTTP Event Collector.

2. In the Actions column, click Enable for the token if it is not already active.

Add an Input

1. Navigate to Cisco ThousandEyes App for Splunk > Inputs.

2. Click Create New Input.

3. Select the input type from the dropdown menu.

4. Fill in the required parameters for the selected input configuration.

5. Click Add Input.

Input Parameters

Tests Stream - Metrics

Parameter	Type	Required?	Description
Name	Textbox	Yes	Unique name for the input
ThousandEyes User	Dropdown	Yes	Select a user created in ThousandEyes User configuration
Account Group	Dropdown	Yes	Account group for data collection
Tags	Multi-valued Dropdown	No	Select tags for easier test selection
Cloud & Enterprise Agent Test	Multi-valued Dropdown	No	Select Cloud and Enterprise Agent tests to collect metrics
Endpoint Agent Test	Multi-valued Dropdown	No	Select Endpoint Agent tests to collect metrics
HEC Target	Textbox/Dropdown	Yes	The Splunk HTTP Event Collector (HEC) target URL for the stream. Examples: For Splunk Cloud Platform: https://http-inputs-<host>.splunkcloud.com:443/services/collector/event For Splunk Enterprise: https://<host>:8088/services/collector/event
HEC Token	Dropdown	Yes	Splunk HEC token for stream data
Test Index	Dropdown	Yes	Index for test metric data
Include Network Path Data	Checkbox	No	Enables collection of Path Visualization data
Path Index	Dropdown	Yes (if Network Path Data is enabled)	Index for Path Visualization data
Path Interval	Textbox	Yes (if Network Path Data is enabled)	Fetch interval for Path Visualization data

Tests Stream - Traces

Parameter	Type	Required?	Description
Name	Textbox	Yes	Unique name for the input
ThousandEyes User	Dropdown	Yes	Select a user created in ThousandEyes user configuration
Account Group	Dropdown	Yes	Account group for data collection
Tags	Multi-valued Dropdown	No	Select tags for easier test selection
Cloud & Enterprise Agent Test	Multi-valued Dropdown	No	Select Cloud and Enterprise Agent tests to collect metrics
HEC Target	Textbox/Dropdown	Yes	The Splunk HTTP Event Collector (HEC) target URL for the stream. Examples: For Splunk Cloud Platform: https://http-inputs-<host>.splunkcloud.com:443/services/collector/event For Splunk Enterprise: https://<host>:8088/services/collector/event
HEC Token	Dropdown	Yes	Splunk HEC token for stream data
Test Index	Dropdown	Yes	Index for test metric data

Event Input

Parameter	Type	Required?	Description
Name	Textbox	Yes	Unique name for the input
ThousandEyes User	Dropdown	Yes	Select a user created in ThousandEyes User configuration
Account Group	Dropdown	Yes	Account group for data collection
Index	Dropdown	Yes	Index for event data
Interval	Dropdown	Yes	Fetch interval for event data

Activity Logs Stream Input

Parameter	Type	Required?	Description
Name	Textbox	Yes	Unique name for the input
ThousandEyes user	Dropdown	Yes	User created in the ThousandEyes user configuration
Account group	Dropdown	Yes	Account group used for data collection, or All to collect from all groups
HEC target	Textbox	Yes	URL for the Splunk HTTP Event Collector (HEC). Example: Splunk Cloud – https://http-inputs-<host>.splunkcloud.com:443/services/collector/event; Splunk Enterprise – https://<host>:8088/services/collector/event
HEC token	Dropdown	Yes	Token value of the configured Splunk HEC input
Activity logs index	Dropdown	Yes	Index used to store activity log data

Alerts Stream Input

Parameter	Type	Required?	Description
Name	Textbox	Yes	Unique name for the input
ThousandEyes User	Dropdown	Yes	Choose the user created from configuration step
Account Group	Dropdown	Yes	Select one account group
Alert Rules	Dropdown	Yes	Select one/multiple alert rules to enable webhook notifications
HEC Target	Dropdown	Yes	HEC Target URL (e.g., https://http-inputs-.splunkcloud.com:443/services/collector/event for Splunk Cloud or https://:8087/services/collector/event for Splunk Enterprise)
HEC Token	Dropdown	Yes	Token value of Configured Splunk HEC Input
Alerts Index	Dropdown	Yes	To get the alerts data into particular index

Note: When you configure an Alerts Stream input, the system will automatically:

• Create a webhook operation in ThousandEyes

• Create a connector for Splunk HEC integration

• Link the webhook operation to the connector

• Update the selected alert rules to use the webhook for notifications

Manage Inputs

Disable an Input

1. Go to Cisco ThousandEyes App for Splunk > Inputs.

2. Find the input you want to disable.

3. In the Actions column, click Disable.

Enable an Input

1. Go to Cisco ThousandEyes App for Splunk > Inputs.

2. Find the input you want to enable.

3. In the Actions column, click Enable.

Edit an Input

1. Go to Cisco ThousandEyes App for Splunk > Inputs.

2. Find the input you want to edit.

3. In the Actions column, click Edit.

4. Update the fields as needed.

5. Click Update to save your changes.

Clone an Input

1. Go to Cisco ThousandEyes App for Splunk > Inputs.

2. Find the input you want to clone.

3. In the Actions column, click Clone.

4. Update the fields as needed.

5. Click Save to create the cloned input.

Delete an Input

1. Go to Cisco ThousandEyes App for Splunk > Inputs.

2. Find the input you want to delete.

3. In the Actions column, click Delete.

4. Confirm the deletion in the pop-up window.