Integrated Enterprise Value for Cisco data
Integrated Enterprise Value (IEV) provides new value for Cisco data that is ingested into Splunk.
Integrated Enterprise Value (IEV) is a Splunk benefit for eligible Cisco-generated data. When Cisco data is ingested into Splunk with a supported sourcetype, that eligible data counts at a 0.5x weighted ingest rate for applicable entitlement consumption. For example, 20 GB/day of eligible Cisco data counts as 10 GB/day of effective commercial consumption.
IEV does not change the actual amount of data stored, indexed, retained, or searched in Splunk. Customers should continue to size Splunk environments, including Splunk Cloud Platform environments, based on actual data volume and expected search activity.
IEV availability, eligibility, and use remain subject to the customer's order, applicable offering terms, the Cisco General Terms or Splunk General Terms (whichever applies), and this supported sourcetype list.
How IEV adds value
With IEV, eligible Cisco data counts against supported Splunk ingest entitlement at a 50% lower weighted rate, giving customers twice the license value for eligible Cisco data compared with standard ingest treatment. This improves the economics of using Splunk as the intelligence layer for Cisco data. With eligible Cisco data searchable in Splunk, customers can use their existing Splunk workflows for investigation, correlation, reporting, detection, and operational analysis.
Prerequisites
To qualify for IEV treatment, Cisco data must meet all of the following requirements:
-
The data must be generated by a Cisco product, service, device, or supported Cisco integration.
-
The data must be ingested into Splunk using one of the supported
sourcetypevalues listed on this page. -
The customer must preserve the supported
sourcetypevalue during ingestion. Custom, renamed, generic, or wildcard-only source types do not qualify unless Splunk explicitly maps them to a supported value. -
The customer must use applicable Splunk data onboarding, add-on, and configuration guidance for the relevant Cisco source.
-
The customer environment must have sufficient capacity for the actual ingest, retention, and search workload. The weighted rate affects entitlement consumption; it does not reduce physical workload.
-
Splunk must be able to validate eligible Cisco usage through available product usage data, reporting, or other approved validation mechanisms.
License scope
IEV applies to eligible Cisco ingest under supported Splunk ingest-based license and pricing paths, subject to the customer's order and applicable terms. Covered scope includes:
-
Splunk Enterprise: Term Ingest >100GB/day license.
-
Splunk Cloud Platform: Ingest license.
-
Activity Based Pricing: applicable to ingest license meter.
Note: For Activity Based Pricing (ABP), the IEV benefit starts only after the customer’s stack is upgraded to Splunk 10.6. It does not apply retroactively to earlier ABP pool consumption.
IEV does not apply to non-ingest pricing metrics unless expressly included in the customer's applicable terms. For example, IEV does not change SVC, vCPU, workload, search, or federated search consumption.
Dashboard reporting
To view IEV in Splunk dashboards, upgrade your Splunk platform to version 10.6 or higher.
After you upgrade:
-
Splunk Cloud Platform: In Cloud Monitoring Console (CMC), go to . The dashboard shows effective license usage and Cisco and non-Cisco usage. On earlier versions, it shows raw ingest. See Monitor current usage of your ingestion-based subscription.
-
Splunk Enterprise: The Monitoring Console (MC)license usage pages include Cisco and non-Cisco views. See Indexing: License Usage.
Effective license usage is the amount counted toward your entitlement after IEV weighting. Raw ingest is the amount of data ingested before weighting and is useful for platform sizing.
Estimate and track Cisco ingest by sourcetype
If you are not on Splunk 10.6 yet, you can use the following search to estimate ingest by sourcetype for the previous 30 days. The search uses a lookup based on the supported Cisco sourcetype list and applies 0.5x weighting to sourcetypes marked as Cisco.
For the most accurate Cisco sourcetype consumption and IEV-weighted entitlement view, contact your Splunk account team.
This search provides a 30-day estimate not a daily average or an entitlement determination.. A sourcetype match alone does not verify Cisco origin or determine contractual eligibility.
Setup guide:
-
Create a CSV with headers sourcetype,
is_ciscoand a row for each supported Cisco sourcetype, using1foris_cisco. -
In Splunk Web, upload it under as
cisco_sourcetypes.csv. -
Create a File-based lookup definition named
cisco_sourcetypesthat points to the CSV. -
Share the lookup file and definition with the app running the search.
-
Verify the lookup with
| inputlookup cisco_sourcetypes.
See Define a CSV lookup in Splunk Web.
Sample SPL:
index=_internal source=*license_usage.log type=Usage earliest=-30d@d latest=now
| stats sum(b) AS bytes BY st
| rename st AS sourcetype
| lookup cisco_sourcetypes sourcetype OUTPUT is_cisco
| eval data_class=if(isnotnull(is_cisco), "Cisco", "Other")
| eval ingest_gb=round(bytes/1073741824, 2)
| eval weighted_gb=if(data_class="Cisco", round(ingest_gb*0.5, 2), ingest_gb)
| appendpipe [
where data_class="Cisco"
| stats sum(bytes) AS bytes
| eval sourcetype="TOTAL CISCO", data_class="Cisco"
| eval ingest_gb=round(bytes/1073741824, 2), weighted_gb=round(ingest_gb*0.5, 2)
]
| table sourcetype data_class ingest_gb weighted_gb
| sort 0 - ingest_gbWhat is not eligible
The following data does not qualify for IEV treatment unless Splunk separately validates and adds it to the supported list:
-
Non-Cisco data.
-
Cisco data that uses generic source types such as
json,csv, or a customer-specific parser name.
-
Cisco data with a renamed or custom
sourcetype.
-
Wildcard discovery patterns such as
cisco:*,cisco*,meraki:*, ormeraki*. These patterns can help find Cisco data, but they are not literal eligibility keys.
-
Add-on operational logs, internal diagnostics, or modular input logs that are not listed as supported sourcetypes.
How entitlement consumption is calculated
Use actual workload for platform sizing and weighted consumption for applicable commercial entitlement.
Effective commercial consumption = non-Cisco or ineligible ingest + (0.5 x eligible Cisco ingest
Actual workload = non-Cisco or ineligible ingest + eligible Cisco ingestExample: If a customer ingests 600 GB/day of eligible Cisco data and 200 GB/day of non-Cisco data, effective commercial consumption is 500 GB/day. The actual workload remains at 800 GB/day.
Supported Add-ons and Apps for Cisco data onboarding
Customers should use the supported Splunkbase Technical Add-ons (TAs) and Apps for the relevant Cisco products when onboarding Cisco data into Splunk. These add-ons and apps provide the supported path for parsing, field extraction, source type assignment, and product-specific data onboarding.
| Supported Splunk add-on or app | Cisco Products and Data scope |
|---|---|
|
Cisco security cloud integrations and Cisco security products, including Secure Firewall, FTD/eStreamer, Firepower, Sourcefire, Snort, Secure Endpoint, Secure Network Analytics/Stealthwatch, XDR, Duo, Email Threat Defense, AI Defense, Identity Intelligence, Secure Malware Analytics, Secure Workload, Multicloud Defense, Network Visibility Module, Endpoint Visibility Module, Isovalent, Vulnerability Intelligence, AnyConnect/Secure Client, and related Security Cloud/SBG data. |
|
|
Cisco ASA, Secure Firewall Threat Defense, Firepower, Sourcefire, Snort, Secure Network Analytics/Stealthwatch flow data, and related firewall syslog source types. |
|
|
Cisco Secure Access, Umbrella/OpenDNS, Cloudlock, DNS, proxy, firewall, private access, ZTNA, RAVPN, DLP, intrusion, web, and related SSE data. |
|
|
Cisco Meraki networks, devices, organizations, access points, wireless, switches, security appliances, cameras, sensors, firewall, flow, webhook, licensing, firmware, and API data. |
|
|
Cisco Catalyst, Catalyst Center/DNAC, Catalyst SD-WAN/Viptela, IOS, Cyber Vision, ISE analytics, ACS-related network access data, access points, WLC, routers, switches, and related network infrastructure data. |
|
| Cisco Catalyst Enhanced Netflow Add-on for Splunk | Collects Netflow v9 and Netflow v10 information from Cisco Catalyst SD-WAN devices |
|
Cisco Identity Services Engine authentication, authorization, policy, TACACS, RADIUS, security-group, and ACS-related network access data. |
|
|
Cisco ACI, Nexus Dashboard, Nexus switches, MSO, syslog, endpoint, flow, protocol, fabric, health, class, managed object, and statistics data. |
|
|
Cisco Intersight alarms, audit records, compute, fabric, network, inventory, metrics, profiles, pools, targets, contracts, advisories, and licenses. |
|
|
Cisco Secure Email Gateway / ESA authentication, mail, AMP, antispam, delivery, bounce, system, and summary email data. |
|
|
Cisco Web Security Appliance proxy, W3C, L4TM, squid, and syslog data. |
|
|
Cisco Unified Computing System and Integrated Management Controller data. |
|
|
Cisco ThousandEyes activity, alerts, events, metrics, traces, path visualization, and related data. |
|
|
Cisco Talos domain, IP, and URL intelligence data. |
|
| Spaces Add-on for Splunk enables the ingestion of location analytics, occupancy insights, device telemetry, and engagement data from Cisco Spaces into Splunk. |
Supported Cisco sourcetypes
This table is not intended to list every eligible source type variation; Splunk may extend the benefit to additional verifiable source types ingested from the listed Cisco products as those source types are reviewed and validated.
| Cisco product | Supported Splunk add-on or app | Supported source types |
|---|---|---|
|
Cisco Secure Firewall |
|
|
|
Cisco Data Center Networking |
|
|
|
Cisco Meraki |
|
|
|
Cisco Access Control Server (ACS) |
Cisco Catalyst Add-on for Splunk; Splunk Add-on for Cisco ISE |
|
|
Cisco AI Defense |
|
|
|
Cisco AnyConnect / Cisco Secure Client |
|
|
|
Cisco Catalyst Center |
|
|
|
Cisco Catalyst SD-WAN |
|
|
|
Cisco Cyber Vision (CCV) |
|
|
|
Cisco Duo Security |
|
|
|
Cisco Email Threat Defense (ETD) |
|
|
|
Cisco Endpoint Visibility Module (EVM) |
|
|
|
Cisco Extended Detection and Response (XDR) |
|
|
|
Cisco Identity Intelligence (CII) |
|
|
|
Cisco Identity Services Engine (ISE) |
|
|
|
Cisco Identity Services Engine (ISE) |
Cisco Catalyst Add-on for Splunk; Splunk Add-on for Cisco ISE |
|
|
Cisco Intersight |
|
|
|
Cisco Isovalent |
|
|
|
Cisco Multicloud Defense (MCD) |
|
|
|
Cisco Network Infrastructure & devices |
|
|
|
Cisco Network Visibility Module (NVM) |
|
|
|
Cisco Secure Access / Umbrella |
|
|
|
Cisco Secure Email Gateway (ESA) |
|
|
|
Cisco Secure Endpoint |
|
|
|
Cisco Secure Firewall - Cisco Adaptive Security Appliance (ASA) |
|
|
|
Cisco Secure Malware Analytics (SMA) |
|
|
|
Cisco Secure Network Analytics (SNA) |
|
|
|
Cisco Secure Network Analytics (SNA) |
|
|
|
Cisco Secure Workload (CSW) |
|
|
|
Cisco Security Cloud |
|
|
|
Cisco Talos |
|
|
|
Cisco ThousandEyes |
|
|
|
Cisco Unified Computing System (UCS) |
|
|
|
Cisco Vulnerability Intelligence (CVI) |
|
|
|
Cisco Web Security Appliance (WSA) |
|
|
|
Cisco Unified Border Element (CUBE) |
- |
|
|
Cisco Unified Communications Manager (CUCM / Call Manager CDR and CMR) |
- |
|
|
Cisco UCCE/PCCE/UCCX contact center platform |
- |
|
|
Cisco Finesse |
- |
|
|
Cisco Customer Voice Portal (CVP), Unified Intelligence Center (CUIC), ICM, and VVB |
- |
|
|
Cisco Webex Meetings, calling, admin/security audit, and Webex Contact Center API data |
|
|
|
Cisco Webex devices/workspaces/room analytics |
- |
|
|
Cisco Expressway / VCS / TelePresence Video Communication Server |
- |
|
|
Cisco Jabber / generic voice/VoIP collaboration telemetry |
- |
|
|
Cisco Meeting Server / Meeting Management |
- |
|
|
Cisco Spaces |
|
|
|
Cisco Prime Infrastructure / EPNM |
- |
|