Configure Splunk Network Intelligence

Understand how to set up data sources and begin using Splunk Network Intelligence to monitor relevant application metrics.

Understand how to configure supported data sources and begin using Splunk Network Intelligence to monitor network inventory, health, alerts, and topology.

Configure data inputs for Network Intelligence

Network Intelligence processes supported network data after it reaches Splunk indexes. It reads data from supported Splunk apps, add-ons, and external collectors to build inventory, health, alerts, and topology. Some integrations send events; Splunk Connect for SNMP can also send numeric objects to a metrics index.

Configure credentials, collection inputs, and collector health in the relevant app, add-on, or external collector. Network Intelligence does not manage those settings.

Configure supported data sources

For each add-on below, install the minimum supported version or later, then enable and configure the listed inputs. The sourcetype identifies the format of each event. Configure every input to write to a destination index that you can select in Network Intelligence.

The collection intervals in these tables are defaults for the listed app and add-on versions. Collection and Network Intelligence processing use separate schedules, so data might not appear immediately after you enable an input. If you change a collection interval, verify that Network Intelligence receives and processes the resulting data.

Cisco Meraki Add-on for Splunk

Use version 3.5.0 or later. Enable the listed inputs for each organization where applicable.

Expected sourcetype or endpoint Input configuration Default collection interval
meraki:devicesavailabilities Enable Devices Availabilities. 24 hours
meraki:switchportsbyswitch Enable Switch Ports By Switch. 24 hours
meraki:devicesuplinkslossandlatency Enable Devices Uplinks Loss And Latency. 24 hours
meraki:devicesuplinksaddressesbydevice Enable Device Uplink Addresses By Device. 24 hours
meraki:assurancealerts Enable Assurance Alerts. Set the initial history window as needed. 1 hour
meraki:organizationsnetworks Enable Organization Networks. 24 hours
meraki:devices Enable Devices. 24 hours
meraki:custom, endpoint_name=switch_ports_usage_history_by_device_by_interval Add a Custom API input. Set query parameters to {"timespan":7200,"interval":1200}. 1 hour
meraki:custom, endpoint_name=switch_ports_statuses_by_switch Add a Custom API input. No query parameters are required. 1 hour
meraki:custom, endpoint_name=devices_topology_l2_links Add a Custom API input. No query parameters are required. 1 hour
meraki:custom, endpoint_name=devices_topology_nodes_discovered Add a Custom API input. No query parameters are required. 1 hour

Cisco Enterprise Networking Add-on for Splunk

Use version 4.0.35 or later for Catalyst Center data.

Expected sourcetype or endpoint Input configuration Default collection interval
cisco:dnac:custom, endpoint_name=topology_physical_topology Add a Custom API input for the physical topology endpoint. Use the endpoint name shown. 1 hour
cisco:dnac:site:topology Enable the Site Topology input. 1 hour
cisco:dnac:devicehealth Enable the Device Health input. 15 minutes
cisco:dnac:devicehealth:interface On the Device Health input, enable interface statistics (enable_interface_stats=1). This is not a separate input. 15 minutes
cisco:dnac:issue Enable the Issue input. 30 minutes

Cisco ThousandEyes App for Splunk

Use version 0.9.0 or later. Configure the app to send stream data to a publicly reachable Splunk HTTP Event Collector (HEC) endpoint that uses HTTPS. Store and protect HEC tokens according to your organization's credential-management requirements. Configure the destination index for each stream.

Expected sourcetype Input configuration
cisco:thousandeyes:metric Configure Tests Stream - Metrics. Select the account group, user, and tests or tags. Set the HEC endpoint, token, and destination index. The optional interval=300 setting applies to related Network Path API collection; it does not set the delivery interval for the metrics stream.
cisco:thousandeyes:alerts Configure Alerts Stream. Select the account group, user, and alert rules. Set the HEC endpoint, token, and destination index. Alert delivery uses a webhook and does not have a polling interval.

Splunk Connect for SNMP

Splunk Connect for SNMP (SC4SNMP) can provide device, interface, and neighbor data for Network Intelligence graph materialization and physical topology. The profile example in this section is for topology polling only; it does not request device health or interface traffic counters. To configure SC4SNMP, see its public documentation, including the profile documentation, inventory documentation, and data format documentation.

Configure a topology polling profile

  • Deploy and configure SC4SNMP for your environment using its supported deployment guide.

  • Add a static polling profile like the following under the existing top-level profiles key in scheduler-config.yaml. Preserve your other profiles, community settings, and group settings.

CODE 
profiles:
  NI_GraphInventory:
    frequency: 1800
    varBinds:
      - [ 'SNMPv2-MIB', 'sysName' ]
      - [ 'SNMPv2-MIB', 'sysDescr' ]
      - [ 'SNMPv2-MIB', 'sysObjectID' ]
      - [ 'SNMPv2-MIB', 'sysLocation' ]
      - [ 'ENTITY-MIB', 'entPhysicalClass' ]
      - [ 'ENTITY-MIB', 'entPhysicalMfgName' ]
      - [ 'ENTITY-MIB', 'entPhysicalModelName' ]
      - [ 'ENTITY-MIB', 'entPhysicalSerialNum' ]
      - [ 'BRIDGE-MIB', 'dot1dBaseBridgeAddress', 0 ]
      - [ 'IF-MIB', 'ifIndex' ]
      - [ 'IF-MIB', 'ifName' ]
      - [ 'IF-MIB', 'ifDescr' ]
      - [ 'IF-MIB', 'ifAlias' ]
      - [ 'IF-MIB', 'ifType' ]
      - [ 'IF-MIB', 'ifPhysAddress' ]
      - [ 'LLDP-MIB', 'lldpLocChassisIdSubtype' ]
      - [ 'LLDP-MIB', 'lldpLocChassisId' ]
      - [ 'LLDP-MIB', 'lldpLocSysName' ]
      - [ 'LLDP-MIB', 'lldpLocPortNum' ]
      - [ 'LLDP-MIB', 'lldpLocPortIdSubtype' ]
      - [ 'LLDP-MIB', 'lldpLocPortId' ]
      - [ 'LLDP-MIB', 'lldpLocPortDesc' ]
      - [ 'LLDP-MIB', 'lldpRemChassisIdSubtype' ]
      - [ 'LLDP-MIB', 'lldpRemChassisId' ]
      - [ 'LLDP-MIB', 'lldpRemPortIdSubtype' ]
      - [ 'LLDP-MIB', 'lldpRemPortId' ]
      - [ 'LLDP-MIB', 'lldpRemPortDesc' ]
      - [ 'LLDP-MIB', 'lldpRemSysName' ]

This profile polls every 1,800 seconds (30 minutes) for system and chassis identity, interface inventory, and LLDP neighbor information used for topology. Devices must support the requested MIB objects for corresponding data to be returned.

  • Assign the profile to the intended device rows in inventory.csv. Preserve the deployment's existing credential references and CSV headers. Keep secrets out of documentation and source control.

  • Confirm that the inventory, scheduler, and deployment paths point to the files SC4SNMP uses. After changing the configuration, reload or recreate the poller using the procedure for your deployment model.

For topology, collect stable identifiers for devices, interface identifiers and names or descriptions, and local and remote neighbor and port identifiers. Network Intelligence uses these values to associate interface and topology records; missing or ambiguous identifiers can prevent a relationship from appearing.

SC4SNMP can send numeric objects to a metrics index and text-only objects to an events index. Select the indexes that contain the SC4SNMP data when you configure the source in Network Intelligence.

Configure data sources in Network Intelligence

After you configure the add-on or collector and its events arrive in Splunk, select the indexed data that Network Intelligence processes. These settings control Network Intelligence processing; they do not configure external integration credentials or collection inputs.

  1. Open Configuration in Network Intelligence and select Data Sources.

  2. Select a source. The list can include Meraki, Catalyst Center, ThousandEyes, and Splunk Connect for SNMP.

  3. To process the source, turn on NI observation and select at least one Index. Select the indexes where the source's events or metrics are stored.

  4. Select Save to apply the source settings.

The saved source status is Disabled when observation is off, Enabled when observation is on and every listed input category has indexed data, and Partial when observation is on but full indexed-input coverage has not been established. These labels describe configuration and coverage; Enabled does not guarantee that every event or measurement is current.

Indexed inputs counts listed input categories with detected data, not devices or events. Analysis progress such as 10/10 means analysis completed for ten entries; it does not mean that all ten contain events. Data check indicates whether an analysis result is available.

Data coverage can show the data type, sourcetype and associated filter, indexed-arrival history, most recent indexed time, and an action for associated Network Intelligence searches. A source can have multiple rows with the same sourcetype but different filters. Analyze sourcetypes checks the selected indexes for the source's listed input categories. Select Cancel analysis to stop an analysis while it is running.

Review or change a source search schedule

In a Data coverage row, select Actions to review the associated Network Intelligence search settings. If the table is wider than the pane, scroll horizontally to reach Actions. Timing is managed per search. The scheduling dialog can show Automatic or manual timing, a search interval, and an ongoing lookback. Automatic uses a detected recommendation when sufficient arrival evidence is available; otherwise, it uses the current default. Manual values are editable when manual mode is selected.

A Data coverage row can summarize multiple searches. Mixed settings means interval or lookback values differ. Search overrides active means at least one associated search uses manual timing. Custom settings or Review search settings means review the dialog instead of relying on a single interval or lookback summary.

Track source backfill

Saving changes to an enabled source or its selected indexes can start an automatic tracked backfill. For an enabled source, select Run backfill to start or retry a run when needed.

  1. Open the source in Configuration > Data Sources.

  2. Review the backfill status and progress, including the current stage and completed work.

  3. Use the available cancel control to stop an active run. Return to the page or refresh it to check the latest run status.

Backfill is a bounded processing pass through the searches for the selected source. A partial, failed, or cancelled run does not undo saved source settings or processing already completed. Recurring searches continue according to their configured schedules. If a Splunk or application process restart interrupts a run, check its status and start another backfill if needed.

Configure application logging

Select Configuration > General to review Application log level. The available levels are DEBUG, INFO, WARNING, ERROR, and CRITICAL. Choosing a level includes messages at that severity and higher. Select Save to apply a changed value; Save is deactivated when there is no unsaved change. This setting controls Network Intelligence diagnostic messages and is separate from device health and alert severity.

Verify your setup

  1. Confirm that the configured add-on or collector is sending events to Splunk.

  2. Confirm that expected events or metrics appear in the destination index and are searchable by the expected sourcetype or metric name.

  3. In Network Intelligence, open Configuration > Data Sources, select the source, and select Analyze sourcetypes.

  4. Review the source Status and Data coverage for the expected input categories.

If expected data is missing, check the collector input, the destination index, and the index selected for Network Intelligence processing.