Inputs

The app provides three input types for data collection:

• Tests Steam - Metrics: Collects test metrics using ThousandEyes OpenTelemetry (OTel) streams and Path Visualization data using the ThousandEyes API.

• Tests Stream - Traces: Collects network trace data from Cloud & Enterprise Agent page-load and web transactions tests.

• Event: Collects detected events from the Cisco ThousandEyes platform using the API.

• Activity logs Stream: Collects activity log data using the OpenTelemetry stream integration instead of traditional polling.

Prerequisites for Tests Stream Inputs

• HTTP Event Collector (HEC) must be enabled.

• The HEC must be reachable from the ThousandEyes platform. For more information, see URL Target Requirements

• SSL must be enabled for HEC.

• At least one HEC token should be configured and enabled.

Enable HTTP Event Collector and SSL

• Splunk Cloud: HEC and SSL are enabled by default.

• Splunk Enterprise:

  1. Go to Settings > Data inputs > HTTP Event Collector.

  2. Click Global settings.

  3. Enable All Tokens.

  4. Check Enable SSL if it is not already enabled.

Note: Ensure the Splunk HEC certificates are valid and not self-signed.

Configure the HTTP Event Collector Token

1. Go to Settings > Data inputs > HTTP Event Collector.

2. Click New Token.

3. Enter a Name and configure optional settings as needed. Click Next.

4. Select Allowed Indexes and update the Default Index if required.

5. Click Review, then click Submit.

Enable the HTTP Event Collector Token

1. Go to Settings > Data inputs > HTTP Event Collector.

2. In the Actions column, click Enable for the token if it is not already active.

Add an Input

1. Navigate to Cisco ThousandEyes App for Splunk > Inputs.

2. Click Create New Input.

3. Select the input type from the dropdown menu.

4. Fill in the required parameters for the selected input configuration.

5. Click Add Input.

Input Parameters

Tests Stream - Metrics

Parameter	Type	Required?	Description
Name	Textbox	Yes	Unique name for the input.
ThousandEyes User	Dropdown	Yes	Select a user created in ThousandEyes User configuration.
Account Group	Dropdown	Yes	Account group for data collection.
Tags	Multi-valued Dropdown	No	Select tags for easier test selection.
Cloud & Enterprise Agent Test	Multi-valued Dropdown	No	Select Cloud and Enterprise Agent tests to collect metrics.
Endpoint Agent Test	Multi-valued Dropdown	No	Select Endpoint Agent tests to collect metrics.
HEC Target	Textbox/Dropdown	Yes	The Splunk HTTP Event Collector (HEC) target URL for the stream. Examples: For Splunk Cloud Platform: https://http-inputs-<host>.splunkcloud.com:443/services/collector/event For Splunk Enterprise: https://<host>:8088/services/collector/event
HEC Token	Dropdown	Yes	Splunk HEC token for stream data.
Test Index	Dropdown	Yes	Index for test metric data.
Include Network Path Data	Checkbox	No	Enables collection of Path Visualization data.
Path Index	Dropdown	Yes (if Network Path Data is enabled)	Index for Path Visualization data.
Path Interval	Textbox	Yes (if Network Path Data is enabled)	Fetch interval for Path Visualization data.

Tests Stream - Traces

Parameter	Type	Required?	Description
Name	Textbox	Yes	Unique name for the input.
ThousandEyes User	Dropdown	Yes	Select a user created in ThousandEyes user configuration.
Account Group	Dropdown	Yes	Account group for data collection.
Tags	Multi-valued Dropdown	No	Select tags for easier test selection.
Cloud & Enterprise Agent Test	Multi-valued Dropdown	No	Select Cloud and Enterprise Agent tests to collect metrics.
HEC Target	Textbox/Dropdown	Yes	The Splunk HTTP Event Collector (HEC) target URL for the stream. Examples: For Splunk Cloud Platform: https://http-inputs-<host>.splunkcloud.com:443/services/collector/event For Splunk Enterprise: https://<host>:8088/services/collector/event
HEC Token	Dropdown	Yes	Splunk HEC token for stream data.
Test Index	Dropdown	Yes	Index for test metric data.

Event Input

Parameter	Type	Required?	Description
Name	Textbox	Yes	Unique name for the input.
ThousandEyes User	Dropdown	Yes	Select a user created in ThousandEyes User configuration.
Account Group	Dropdown	Yes	Account group for data collection.
Index	Dropdown	Yes	Index for event data.
Interval	Dropdown	Yes	Fetch interval for event data.

Activity Logs Stream Input

Parameter	Type	Required?	Description
Name	Textbox	Yes	Unique name for the input.
ThousandEyes user	Dropdown	Yes	User created in the ThousandEyes user configuration.
Account group	Dropdown	Yes	Account group used for data collection, or All to collect from all groups.
HEC target	Textbox	Yes	URL for the Splunk HTTP Event Collector (HEC). Example: Splunk Cloud – https://http-inputs-<host>.splunkcloud.com:443/services/collector/event; Splunk Enterprise – https://<host>:8088/services/collector/event.
HEC token	Dropdown	Yes	Token value of the configured Splunk HEC input.
Activity logs index	Dropdown	Yes	Index used to store activity log data.

Manage Inputs

Disable an Input

1. Go to Cisco ThousandEyes App for Splunk > Inputs.

2. Find the input you want to disable.

3. In the Actions column, click Disable.

Enable an Input

1. Go to Cisco ThousandEyes App for Splunk > Inputs.

2. Find the input you want to enable.

3. In the Actions column, click Enable.

Edit an Input

1. Go to Cisco ThousandEyes App for Splunk > Inputs.

2. Find the input you want to edit.

3. In the Actions column, click Edit.

4. Update the fields as needed.

5. Click Update to save your changes.

Clone an Input

1. Go to Cisco ThousandEyes App for Splunk > Inputs.

2. Find the input you want to clone.

3. In the Actions column, click Clone.

4. Update the fields as needed.

5. Click Save to create the cloned input.

Delete an Input

1. Go to Cisco ThousandEyes App for Splunk > Inputs.

2. Find the input you want to delete.

3. In the Actions column, click Delete.

4. Confirm the deletion in the pop-up window.