Configure inputs for the Splunk Add-on for Cisco Meraki

To configure inputs for the Splunk Add-on for Cisco Meraki, complete these steps:

1. On Splunk Web, go to the Splunk Add-on for Cisco Meraki, either by clicking the name of this add-on on the left navigation banner or by going to Manage Apps, then clicking Launch App in the row for the Splunk Add-on for Meraki.
2. Click the Inputs tab.
3. Click Create new input.
4. Fill in the required fields:

   Field	Description
   Name	A name for the new input.
   Organization	The Cisco Meraki organization to collect data from.
   Start from	Available only for "Audit" input and applicable only for the first time. Indicates the number of days in the past this add-on should get data from. If not set, default is 1.
   Interval	How often, in seconds, the Splunk platform calls the API to collect data. Set to 360 seconds or above to avoid rate limiting errors.
   Index	The index in which the Splunk platform stores events from Cisco Meraki. The default is main.

   When you enable the input for the first time, the add-on collects historical event data for 24 hours in the past by default, or starts collection at a different time based on what you configured on the setup page (applicable only for "Audit" input).

5. Once you are satisfied with the configurations, click Enable next to the inputs you want to enable.

Migrate from an existing add-on

If an existing add-on is used to collect data from Cisco Meraki, this add-on can be utilized to collect more data (for example, configuration changes events which are not covered by an existing add-on).

There are no contraindications in running both existing and new add-ons if you want to verify that data is being collected correctly.