• Splunk version 6.3, 6.4 and 6.5
• APIC system running 1.1(4e), 2.0(x), 2.1(1h) and 2.1(1i) Version
• Admin user ID and password for collecting data from APIC.
• Splunk search head system should have 16 GB of RAM and a octa-core CPU to run this app smoothly.
Install main app (Cisco ACI App for Splunk Enterprise) and Add-on app (Cisco ACI Add-on for Splunk Enterprise) on a single machine.
• Here both the app resides on a single machine.
• Main app uses the data collected by Add-on app and builds dashboard on it
• This Add-on app can be installed through UI using "Manage Apps" or extract zip file directly into /opt/splunk/etc/apps/ folder.
• Restart Splunk.
• Note: If the previous version of App is already installed, remove the TA_cisco-ACI folder from Splunk app folder before installation of newer version.
Step 1: SSL Configuration:
• The SSL Connection with APIC is enabled by default. Users first need to create custom certificate with proper Domain name for APIC and load the updated certificate for SSL verification.
• The procedure to create a custom certificate for Cisco ACI for HTTPS Access is given in below link:
Custom Certificate for Cisco ACI HTTPS Access
• If users wants to disable SSL verification follow the procedure given in next section.
To disable the SSL verification do the following steps: Open config.ini file at $APP_HOME/TA_cisco-ACI/bin/ directory Set ENABLE_SSL = False Open acisession.py file at $APP_HOME/TA_cisco-ACI/bin/ directory Set verify_ssl = False (line 443)
Step 2: Enter APIC Credentials:
• Login to Splunk: http://your_splunk_host:port, Go to the Apps->Manage Apps and open "Setup" screen for Cisco ACI Add-on for Splunk Enterprise. It will open a set up screen which will ask for ACI credentials. Please provide IP address/domain name, Username, Password and Save.
• Only app Version 3.0 & 4.0 supports multiple APIC entries. Provide more ACI credentials through setup screen. Have max 5 APIC's configured for better performance.
• Splunk REST API will encrypt the password and store it in app itself(local/passwords.conf) in encrypted form. Data collector script will fetch these credentials through REST API to connect to the APIC.
• Whenever User wants to change the credentials, he/she needs to remove the current entry from directory TA_cisco-ACI/local/passwords.conf first. Restart the Splunk. Provide the credentials through Setup screen.
Step 3: Enable Collector Scripts:
• User also needs to modify "default/inputs.conf" according to the following guidelines.
• This file contains filename paths which are different based on your OS platform.The app is configured to work for Unix/Linux/MacOS systems.
If you are running this app on a Windows system, perform the following step: • Copy the file "default/inputs.conf.WINDOWS" to "local/inputs.conf"
• Each entry in default/input.conf contains a field "passAuth" with default value admin. This field can contain any splunk user with admin rights.
• Enable Data collector Scripts through UI (Settings->Data inputs->Local inputs->Scripts).
• On Windows enable following collector scripts:
• $SPLUNK_HOME\etc\apps\TA_cisco-ACI\bin\collect.py -health fvTenant fvAp fvEPg fvAEPg fvBD vzFilter vzEntry vzBrCP fvCtx l3extOut fabricHealthTotal fabricNode eqptcapacityPolEntry5min eqptFabP eqptLeafP eqptCh eqptLC eqptFt eqptPsu eqptSupC ethpmPhysIf • $SPLUNK_HOME\etc\apps\TA_cisco-ACI\bin\collect.py -authentication aaaSessionLR • $SPLUNK_HOME\etc\apps\TA_cisco-ACI\bin\collect.py -classInfo faultInst topSystem compVm compHv fvCEp fvRsCons fvRsProv fvRsVm fvRsHyper fvRsPathAtt vmmCtrlrP compHostStats1h compRcvdErrPkts1h compTrnsmtdErrPkts1h fvRsCEpToPathEp dbgEpgToEpgRslt dbgEpToEpRslt dbgAcTrail aaaUser aaaRemoteUser l1PhysIf • $SPLUNK_HOME\etc\apps\TA_cisco-ACI\bin\collect.py -classInfo aaaModLR faultRecord eventRecord • $SPLUNK_HOME\etc\apps\TA_cisco-ACI\bin\collect.py -stats fvAp eqptEgrTotal5min eqptIngrTotal5min fvCEp l2IngrBytesAg15min l2EgrBytesAg15min • $SPLUNK_HOME\etc\apps\TA_cisco-ACI\bin\collect.py -microseg fvAEPg fvAp fvRsDomAtt
• On Linux enable following collector scripts:
• ./bin/collect.py -health fvTenant fvAp fvEPg fvAEPg fvBD vzFilter vzEntry vzBrCP fvCtx l3extOut fabricHealthTotal fabricNode eqptcapacityPolEntry5min eqptFabP eqptLeafP eqptCh eqptLC eqptFt eqptPsu eqptSupC ethpmPhysIf • ./bin/collect.py -authentication aaaSessionLR • ./bin/collect.py -classInfo faultInst topSystem compVm compHv fvCEp fvRsCons fvRsProv fvRsVm fvRsHyper fvRsPathAtt vmmCtrlrP compHostStats1h compRcvdErrPkts1h compTrnsmtdErrPkts1h fvRsCEpToPathEp dbgEpgToEpgRslt dbgEpToEpRslt dbgAcTrail aaaUser aaaRemoteUser l1PhysIf • ./bin/collect.py -classInfo aaaModLR faultRecord eventRecord • ./bin/collect.py -stats fvAp eqptEgrTotal5min eqptIngrTotal5min fvCEp l2IngrBytesAg15min l2EgrBytesAg15min • ./bin/collect.py -microseg fvAEPg fvAp fvRsDomAtt
NOTE: For Version 4.0 there will be 6 collector scripts which needs to be enabled.
• Don't restart splunk right after enabling collector scripts. Restarting will interrupt the process of pulling data from APIC.
• Open the app, Landing page is Home page. The main app dashboard can take some time before the data is populated in all panels. Follow the Test Installation procedure.
• Login to Splunk: http://your_splunk_host:port
• Complete instruction is also available as “Setup Guide” tab in Cisco ACI App for Splunk Enterprise.
Search with "index="apic" | stats count by sourcetype" command and make sure you see following sourcetypes
If you don't see these sourcetypes, have a look at the messages output by the scripted input: collect.py. Here is a sample search that will show them:
index=_internal component="ExecProcessor" collect.py "ACI Error:" | table _time host log_level message
Fetching additional data
If user wants to fetch additional data and is familiar with ACI Object model, he/she can add new stanza in default/inputs.conf file. Example is shown below:
Version 4.1 Updates (compatible with ACI app v4.1):
Revised inputs.conf - script calls
Updated sample data files
All features existing in the version 4.0
Updated sample data files to reflect current APIC version data
Minor bug fixes
The features developed in this release include: *Multi-Pod integration * Micro-segmentation support * Supports multiple APIC's * Enabled SSL connection with APIC.
The features developed in this release include: * Supports multiple APIC's * Enabled SSL connection with APIC.
The features developed in this release include:
* Migrating the existing Cisco ACI Add-on application for Splunk from using ACI Python SDK to ACI REST APIs.
* Enabled SSL connection with APIC.
There is no impact on the existing Cisco ACI application due to the changes done in Cisco ACI Add-on.
Splunk's App Certification program uses a specific set of criteria to evaluate the level of quality, usability and security your app offers to its users. In addition, we evaluate the documentation and support you offer to your app's users.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 50GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.