Network Intelligence Application

Splunk Network Intelligence provides a unified view of supported Cisco-managed network data, including inventory, health, alerts, and topology context.

Splunk Network Intelligence brings supported network data together in Splunk. Use the app to review network health by site, find devices, inspect device and interface details, investigate alerts, and explore physical topology and reported traffic.

Network Intelligence reads events collected by supported add-ons and external collectors. What appears in the app depends on the data collected, indexed, and processed. A missing value or unavailable view does not by itself mean that a device, connection, or measurement does not exist.

Get data in for Splunk Network Intelligence

Install and configure the appropriate Splunk Technical Add-on before you use Splunk Network Intelligence. For setup instructions, see Configure Splunk Network Intelligence.

Supported data sources

Splunk Network Intelligence uses Splunk apps and add-ons to collect data from supported Cisco-managed networking solutions:

Install and configure the relevant Splunk app or add-on so that its data is available in Splunk Network Intelligence. The details shown for each device, entity, or alert depend on data from its source. For more information, see Configure Splunk Network Intelligence.

Use the left navigation to open:

  • Home for network and site summaries.

  • Devices for the device and entity inventory.

  • Alerts for source-reported alert records and filters.

  • Sites for the site inventory and site details.

  • Configuration for data source settings and general application settings.

Review network status

The Home page provides a network summary and site cards.

  1. Open Home.

  2. Review the network summary and site cards.

  3. To focus on one site, open the Site selector and choose a site. To restore the network view, select All sites.

  4. Select a site name to open Site Details. Select its alert-count link to open Alerts scoped to that site.

A site summary can include device availability, device counts by status, uplink utilization, latency, packet loss, alert counts, and a trend for the selected time period. The fields and history depend on the available source data. Read each value with its label, unit, and observation time. A health percentage, devices needing attention, an alert count, and a source-reported status are separate measures. Home health percentages are displayed with at most one decimal place. Use the available column headers to sort the site health details table. Changing the sort order resets the results to the first page.

Browse sites and review site details

  1. Open Sites.

  2. Search or browse the site list. Select Site name to sort where the sort control is available.

  3. Use pagination to move through the list.

  4. Select a site name to open Site Details.

Site Details can show source-reported properties, associated devices, and physical topology. Site properties, such as a source-reported status, are distinct from the health summary shown on Home.

Find a device and review its details

  1. Open Devices.

  2. Enter a device name or supported identifier in Search devices.

  3. Use the site or other available filters to narrow the inventory.

  4. Use the pagination controls to move through results.

  5. Select a device name to open Device Details.

The inventory can include reported status, connectivity, alert count, type, model, source, site, and address. Available columns depend on the data returned. Status and Connectivity are separate reported values. A blank, dash, or unavailable label is not a numeric zero.

Search supports device names and identifiers such as serial numbers or MAC addresses where those identifiers are indexed and mapped to the device. Search, sort, and filter behavior can reset the result page to the first page.

Health and alerts

The Health and alerts tab shows available device alerts and health measurements. KPI groups can include availability, CPU, memory, interface status, packet loss, or other source-provided measurements. Historical charts show observations for the selected period when history is available. Each group can have its own update time; an older observation is not necessarily a current measurement.

Use History lookback to select the period requested for device KPI history. This control is separate from the Alerts page time filter. Unavailable or stale measurements are not equivalent to measured zero or a healthy state.

Use Open in alert list, when available, to open Alerts scoped to the current device. The device scope uses the device record, not merely its display name or site.

Interfaces

Select Interfaces to inspect the interfaces returned for the selected device. Use Grid view or Table view to change the presentation. The panel can show interface counts, status summaries, interface health, administrative and operational status, speed, peer connections, and available KPI history.

Interface health, administrative status, operational status, speed, and connection are different fields. For example, an interface can report an ok health label while its operational status is Disconnected. No connection reported means that no matching connection was returned; it does not by itself establish that the interface is deactivated or unhealthy.

When an interface lists a connected peer, select the peer link to open that device's Interfaces tab. The link opens the peer device; it does not necessarily select the named peer interface. Interface measurements can include throughput, power, status, and packet loss history when supported by the source.

Use Related to inspect related entities returned for the selected device. Use Details to review descriptive source properties such as identifiers, model, firmware, device type, or management address. Available fields depend on the source.

Explore physical topology

Device Details and Site Details can show physical Layer 1 and Layer 2 topology: devices or other network items as nodes and reported connections as links. The displayed graph depends on the source data returned.

On Device Details, use Scope to select 1, 2, or 3 hops from the current device. The default is two hops. Site Details can provide the same hop choices from the site's topology seed set, with one hop as its default. Changing scope requests a different graph. A larger scope can show more items only when they are present in the returned topology.

Select a node to inspect its summary. Double-click a device node to open that device's details when navigation is supported. Select a connection to inspect its endpoints, reported health, interface identifiers, and available traffic. Unsupported or discovered-neighbor items might not have a full device record.

Use Traffic to show or hide reported traffic labels on the graph. Turning labels off does not remove nodes, links, or directional arrows. Device-wide totals, connection rates, and interface measurements are separate values; a device total can be unavailable while connection or interface rates are present.

Use the graph controls to open the legend, zoom, fit, reset, or move nodes. Moving a node changes its position in the current diagram; it does not change source properties or network connections. Health and connection meaning must remain available without color alone; use the legend's confirmed symbols or labels when provided.

Unavailable topology, health, or traffic data should not be interpreted as proof that no connection or traffic exists. Read the displayed message and source context when investigating missing information.

Investigate alerts

  1. Open Alerts.

  2. Choose a time range, such as Last 24 hours, Last 7 days, or Last 30 days. Select a site or All sites, and choose Open, Closed, or All statuses.

  3. Select a severity: Critical, High, Medium, Low, or Informational. Choose None when you do not want to filter by severity.

  4. Enter an alert name in the name search field. Its placeholder is Search name.

  5. Review the matching rows. Sort by Severity or Source where those controls are available, and use device or site links to continue the investigation.

  6. Use the pagination controls above or below the results when available.

Alerts can include normalized data from supported sources such as Cisco Catalyst Center and Cisco ThousandEyes. The table can show severity, alert, device, site, and source. Some records might not have an associated device or site. A named site filter should show alerts associated with that site, not rows with an unknown site. The site breakdown can include Unassigned for records without a site association. Summary cards and breakdowns can aggregate a broader set than the filtered rows; interpret each count in its own context.

The severity and site summary rail can be collapsed to make more room for results. Changing filters or search can reset pagination to the first page. The exact available controls depend on the deployed release and the user's permissions.

Configure sources and application settings

Use Configuration to review indexed data sources, source coverage, and application settings. This page does not configure external integrations or credentials. For source settings, analysis, search schedules, backfill, and application logging, see Configure Splunk Network Intelligence.