splunk
Cisco Intersight Add-on for Splunk
Splunk Cloud
Overview
Details
Cisco Intersight Add-on for Splunk is a Cisco supported extension to Splunk platform designed to integrate Cisco Intersight's powerful infrastructure management capabilities with Splunk's robust data analysis platform. This add-on enables IT administrators and engineers to collect, monitor, and analyze data from Cisco Intersight, providing deep insights into their data center operations and enhancing their ability to manage infrastructure efficiently.
The Cisco Intersight Add-on for Splunk enables data collection from key sources including Alarms, Audit Logs, Inventory, and Metrics within the Cisco Intersight platform. It also includes pre-built dashboards that provide high-level insights into the collected data, allowing for faster analysis and streamlined monitoring.
For more information: Please refer to the User Guide: https://intersight.com/help/saas/resources#intersight_add-on_for_splunk
NOTE: This version is not compatible with the older version of this add-on (https://splunkbase.splunk.com/app/6482)
The Cisco Intersight Add-on for Splunk enables data collection from key sources including Alarms, Audit Logs, Inventory, and Metrics within the Cisco Intersight platform. It also includes pre-built dashboards that provide high-level insights into the collected data, allowing for faster analysis and streamlined monitoring.
For more information: Please refer to the User Guide: https://intersight.com/help/saas/resources#intersight_add-on_for_splunk
NOTE: This version is not compatible with the older version of this add-on (https://splunkbase.splunk.com/app/6482)
OVERVIEW
- The Cisco Intersight Add-on for Splunk allows Splunk software administrators to collect Intersight Managed Inventory, Alarms, Advisories, Audit logs, and Performance metrics from the Cisco Intersight platform into Splunk. This add-on provides the inputs and CIM-compatible knowledge to use with other Splunk Enterprise apps, such as Splunk Enterprise Security and Splunk IT Service Intelligence. By integrating with multiple Cisco Intersight environments, it enables a unified approach to collect data in a multi-account landscape.
- This is an enhanced and updated version of the older version by the same name
- Note: This add-on is not backward compatible with the older version. Please ensure the older version is uninstalled before installing this one.
REQUIREMENTS
- For the system requirements of Splunk Enterprise, please refer to the Splunk Enterprise Installation Manual - System Requirements.
COMPATIBILITY MATRIX
- Splunk version: 10.0, 9.4.x, 9.3.x, 9.2.x
- Python version: Python3
- OS Support: Linux, MacOS
- Browser Support: Independent
- Intersight Product: Intersight SaaS, Intersight Appliance
RECOMMENDED SYSTEM CONFIGURATION
- Standard Splunk Enterprise configuration of Search Head, Indexer and Forwarder.
Deployment Architecture
The Cisco Intersight Add-on for Splunk supports both standalone and distributed deployment architectures.
Where to Install in a Distributed DeploymentNavigate to: Apps > Cisco Intersight Add-on for Splunk > Configuration > Account.
| Splunk Platform Type | Supported | Required | Comments |
|---|---|---|---|
| Search Heads | Yes | Yes | Install on all search heads where Cisco Intersight knowledge management is required. Best practice is to turn add-on visibility off to prevent data duplication errors. |
| Indexers | Yes | No | Not required; parsing occurs on heavy forwarders. |
| Heavy Forwarders | Yes | Yes | Supports heavy forwarders for data collection. |
| Universal | No | No | Due to python code(Modular Inputs), it is not supported. |
Release Notes
Version 3.0.0
Aug. 16, 2025
KV Store Integration for Inventory Objects. The Inventory changes are ingested into the specified Index as well
Network Troubleshooting Insights
Physical CPU Utilization Metrics
Automatic Default Input Creation
Added support to fetch Advisory definitions alongwith Advisory Instances.
Addition of Ports & Interfaces objects in Inventory data collection
Token Expiration timestamp Visibility in Add-on's Configuration page.
Added support to fetch Cleared and Info Alarms
Prebuilt Sample Reports
Bug Fixes:
Resolved an issue where Graphics card data was not being included in inventory collection.
Version 2.0.1
April 16, 2025
- Built on Splunk UCC Framework for a streamlined and customizable experience.
- Support for OAuth 2.0 Authentication Mechanism ensuring secure and seamless integration.
- Comprehensive Metrics Collection to enhance performance monitoring and analysis.
- Prebuilt Panels for Dashboards to provide quick insights into Cisco Intersight data.
- Reliable Alarm Ingestion Mechanism to ensure accuracy and prevent duplicates.
- Configurable Polling Intervals for optimized Inventory Data collection.
- Extensive Data Collection Capabilities with APIs for Inventory and Metrics.
- Checkpointing and KV Store Integration for improved data consistency and management.