Install the Content Pack for Cisco ThousandEyes

Perform the following high-level steps to install the Content Pack for Cisco ThousandEyes:

1. Ensure that you meet the prerequisites.
2. Install the content pack.
3. Ensure the content pack uses the correct index.

Prerequisites

You must meet the following prerequisites to install and configure the Content Pack for Splunk AppDynamics.

Prerequisite	Description
Back up your environment	Create a full backup of your IT Service Intelligence (ITSI) environment in case you need to uninstall the content pack later. See Create a full backup of ITSI.
Install the Splunk App for Content Packs	The content pack requires the Splunk App for Content Packs. For installation steps, see Install the Splunk App for Content Packs.
Install and configure the Cisco ThousandEyes App for Splunk	The content pack requires data collected from the Cisco ThousandEyes App for Splunk. For installation and configuration steps, see Cisco ThousandEyes App for Splunk in the Cisco ThousandEyes documentation.
Configure the tests stream input in the Cisco ThousandEyes App for Splunk	The content pack requires the tests stream input to be configured in the Cisco ThousandEyes App for Splunk. For configuration steps, see Inputs in the Cisco ThousandEyes documentation. Note: Enabling the Splunk HTTP Event Collector (HEC) receiver and SSL is required to configure this test input. If you need to open firewall exceptions for the HEC receiver, see Firewall Exception Requirements in the Cisco ThousandEyes documentation.

Step 1: Install the content pack

To install the Content Pack for Cisco ThousandEyes:

1. From the ITSI main menu, select Configuration, then Data Integrations.
2. Select the Content library tab.
3. Under Splunk Supported Content Packs, select Cisco ThousandEyes.
4. Follow the on-screen instructions to install the content pack.

Step 2: Ensure the content pack uses the correct index

The Content Pack for Cisco ThousandEyes uses a search macro to ensure all searches use the same index. The search macro must be configured to use the same index that the Cisco ThousandEyes App for Splunk uses to ingest data.

When the Cisco ThousandEyes App for Splunk is installed on indexers, it automatically creates an events index named thousandeyes. By default, both the Cisco ThousandEyes App for Splunk and Content Pack for Cisco ThousandEyes are configured to use this index.

If you installed the Cisco ThousandEyes App for Splunk on your indexers and did not change the index configuration for the add-on, this step is optional.

Prerequisite

You must have the admin role to perform this step.

Steps

1. (Optional) If you need to create an index, see Create events indexes.
2. Identify the index that the Cisco ThousandEyes App for Splunk uses:
   1. From the Splunk Enterprise main menu, select Apps, then select Cisco ThousandEyes App for Splunk.
   2. The Inputs tab is selected by default. Identify the tests stream input configured to collect Cisco ThousandEyes test event data and expand the row for the input.
   3. Identify the value set for the Test Index.
3. Update the content pack search macro to use the same index as the add-on:
   1. From the Splunk Enterprise main menu, select Settings, then Advanced Search.
   2. Select Search Macros.
   3. In the App drop-down menu, select Cisco ThousandEyes (DA-ITSI-CP-thousandeyes).
   4. Select itsi_cp_thousandeyes_index. By default, the macro definition is set to index="thousandeyes". In the Definition field, change the index value to the index used by the Cisco ThousandEyes App for Splunk.
   5. Select Save.

Next steps

After you install the content pack, you can start monitoring your Cisco ThousandEyes services and entities. See See Monitor Cisco ThousandEyes services and Monitor Cisco ThousandEyes entities.