Configure Cisco Catalyst Center and Cisco Meraki alerts for ITSI 4.21.x and higher
Configure Cisco Catalyst Center and Cisco Meraki alerts for ITSI 4.21.x and higher.
The Cisco Catalyst Add-On for Splunk and Cisco Meraki Add-on for Splunk do not normalize alerts data. To ingest and normalize alerts from Cisco network devices to ITSI 4.21.x and higher, you can use either of the following methods:
Activate the default connections in the Cisco Catalyst Center or Cisco Meraki data integrations. The default connections are prefilled with the required data fields to normalize alerts as well as the optional Entity Lookup Field, which is used by ITSI to determine which services and entities are affected by an alert. The default connections set the Entity Lookup Field to SiteNameHierarchy for Cisco Catalyst Center and network.name for Cisco Meraki.
Create a new data connection using the Cisco Catalyst Center or Cisco Meraki data integrations. These data integrations include templates that you can use to map data fields to normalize alerts.
Cisco Catalyst Center alerts use the sourcetype cisco:dnac:issue. Cisco Meraki assurance alerts use the sourcetype meraki:assurancealerts.
For more information about data normalization, see Overview of the Splunk Common Information Model.
Activate the default connections in the Cisco Catalyst Center and Cisco Meraki data integrations
Complete the following steps to activate the default connections in the Cisco Catalyst Center and Cisco Meraki data integrations.
From the ITSI main menu, select Configurations, then Data Integrations.
The Integrations library tab is selected by default. Under Alerts, select Cisco Catalyst Center or Cisco Meraki.
Select catalyst_center_default or meraki_default.
Select the actions menu (...) next to Inactive.
Select Activate.
Select Save.
Create a new connection in the Cisco Catalyst Center and Cisco Meraki data integrations
Complete the following steps to create a new connection in the Cisco Catalyst Center and Cisco Meraki data integrations.
From the ITSI main menu, select Configurations, then Data Integrations.
The Integrations library tab is selected by default. Under Alerts, select Cisco Catalyst Center or Cisco Meraki.
Select Add connection.
Follow the on-screen instructions.
(Optional) Configure additional alerts
For more information on configuring different types of alerts, see the topics under KPI alerting in the Service Insights manual.
You can also use the Content Pack for ITSI Monitoring and Alerting to configure additional alerting and service monitoring capabilities. For more information, see About the Content Pack for ITSI Monitoring and Alerting.