icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.
Log4Shell Vulnerability: Information and guidance for you. Get resources.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Cisco Network Assurance Engine App for Splunk Enterprise (Cisco NAE)
SHA256 checksum (cisco-network-assurance-engine-app-for-splunk-enterprise-cisco-nae_250.tgz) 4238060338d1b91de3f90bd65a6e3bc745fc57dba0a6c79fcfff8b5d7784d467 SHA256 checksum (cisco-network-assurance-engine-app-for-splunk-enterprise-cisco-nae_240.tgz) a53f3f53cb4d5503e13983ce1a8aa6bb5c07182cb2913db59130687db8803e72 SHA256 checksum (cisco-network-assurance-engine-app-for-splunk-enterprise-cisco-nae_230.tgz) 6292e445b789f1d418cb86db59f916cc069771ff42d5a5c53586eb044f5833ca SHA256 checksum (cisco-network-assurance-engine-app-for-splunk-enterprise-cisco-nae_220.tgz) 8bc452b0a6ffd346253cb051b81518830346421a275f516c3ad1f5cf8d3b31d0 SHA256 checksum (cisco-network-assurance-engine-app-for-splunk-enterprise-cisco-nae_210.tgz) dc8c0824f2b97db48cfefe0b55cf406bddeb7eec4e6763a9cfb8b9813381cfce SHA256 checksum (cisco-network-assurance-engine-app-for-splunk-enterprise-cisco-nae_200.tgz) 8f6e5fc0ff74793f0b55053f1d34b020ae4af382799faf55349b816a1136afa9 SHA256 checksum (cisco-network-assurance-engine-app-for-splunk-enterprise-cisco-nae_122.tgz) e0d13db082d68afca74fc101da7676a84f034d86d037100c5c8f41ae967ab44c SHA256 checksum (cisco-network-assurance-engine-app-for-splunk-enterprise-cisco-nae_121.tgz) 902ff1f910658d68f412d23c7848b6881e52e62c2b66087f19f3cec18c0fc3eb SHA256 checksum (cisco-network-assurance-engine-app-for-splunk-enterprise-cisco-nae_12.tgz) 9a40088cf226e89d0f58ad976344d28dd227a04be84116b2c14968075e232d4f SHA256 checksum (cisco-network-assurance-engine-app-for-splunk-enterprise-cisco-nae_11.tgz) 9358a105d4d0bd4be56eea40652566b732d7553db4ff294840e0ee11d51688c2 SHA256 checksum (cisco-network-assurance-engine-app-for-splunk-enterprise-cisco-nae_10.tgz) e20ab6474d95b153a0ab108c8f987069ec88970950e4224992fd9ce95c50245c
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

splunk

Cisco Network Assurance Engine App for Splunk Enterprise (Cisco NAE)

Splunk Cloud
Overview
Details
Cisco Network Assurance Engine is an intent assurance appliance for ACI (Application Centric Infrastructure) which raises issues or concerns as Smart Events against the Intent in ACI and providing information on what could be affecting the underlying infrastructure configurations, helping mitigate direct impact on daily business services.

Please ask questions by creating a TAC case on https://globalcontacts.cloudapps.cisco.com/contacts/contactDetails/en_US/c1o1-c2o2-c3o8
OR contact us at 1 800 553 2447 or 1 408 526 7209

ABOUT THIS APP

The Cisco Network Assurance Engine (NAE) app for Splunk Enterprise is used to build dashboards on indexed data provided by "Cisco Network Assurance Engine Add-on for Splunk Enterprise" app

This app delivers centralized, real-time visibility for smart events from NAE to analyze and inspect issues in your data center fabric along with historical correlations between events in epochs to show how a particular smart event behaves over time

REQUIREMENTS

  • Splunk version supported 7.2, 7.3 and 8.0
  • This main App requires "Cisco Network Assurance Engine Add-on for Splunk Enterprise" version 2.5.0

Recommended System configuration

  • Splunk search head system should have 16 GB of RAM and a octa-core CPU to run this app smoothly.

Topology and Setting up Splunk Environment

Install main app (Cisco NAE App for Splunk Enterprise) and Add-on app (Cisco NAE Add-on for Splunk Enterprise) on a single machine.
Here both the app resides on a single machine.
Main app uses the data collected by Add-on app and builds dashboard on it

Install Main app and Add-on app on a distributed environment.
Main app uses the data collected by Add-on app and builds dashboard on it.
1. Install and configure the Add-on into the Heavy forwarder or one of the Indexer
2. Install the Main app into the Search Head or Search Head cluster

Installation of App

  • This app can be installed through UI using "Manage Apps" or extract zip file directly into /opt/splunk/etc/apps/ folder.
  • Restart Splunk.
  • Login to Splunk: http://<your_splunk_host:port>
  • Open browser: http://<your_splunk_host:port>/en-US/debug/refresh. Click "Refresh"
  • Open browser: http://<your_splunk_host:port>/en-US/_bump
    (To pull all updated web resources from the server to the browser, to modify the cached items such as js, cookies, images etc..)
  • Restart Splunk

  • Note:
    1) If the previous version of App is already installed, remove the cisco-app-candid folder from Splunk app folder before installation of newer version.
    2) If in case cleaned Splunk eventdata, please make sure to delete the 3 files ending with last_pull_epoch_time.txt from TA_cisco-candid/bin/ folder.
    These files are saving timestamp to get only incremental data from APIC.

Installation of Add-on

  • This Add-on app can be installed through UI using "Manage Apps" or extract zip file directly into /opt/splunk/etc/apps/ folder.
  • Ref documentation provided by "Cisco NAE Add-on for Splunk Enterprise" for Configuration of Add-on

  • Note: If the previous version of Add-on app is already installed, remove the TA_cisco-candid folder from Splunk app folder before installation of newer version.

Upgradation of App/Add-on

Please disable all the scripted inputs before upgrading Add-on(TA_cisco-candid).
Download the App package
From the UI navigate to Apps->Manage Apps
In the top right corner select "Install app from file"
Select "Choose File" and select the App package
Check Upgrade App
Select "Upload" and follow the prompts.
#### OR
* If newer version is available on splunkbase, then App/Add-on can be updated from UI also.
* From the UI navigate to Apps->Manage Apps OR click on gear icon
* Search for Cisco NAE App/Add-on
* Click on 'Update to <version>' under Version Column.

Post upgradation steps

Upgrading the Add-on(TA_cisco-candid) to v2.4.0 from any version

Please follow the below steps.

  • If you have add-on installed in Windows enviornment and there is last_pull_epoch_time.txt file under TA_cisco-candid/local folder, then perform following steps.
  • Check permission of last_pull_epoch_time.txt file:
    • Right Click on local/last_pull_epoch_time.txt.
    • Navigate to Properties -> Security.
    • Check the permission for SYSTEM.
  • If there is no permission for SYSTEM then follow below steps:
    • If scripted input is already enabled then first disable it.
    • Right Click on local/last_pull_epoch_time.txt.
    • Navigate to Properties -> Security.
    • Click on Edit button.
    • Click on Add button.
    • Enter SYSTEM in Enter the object names to select box.
    • Click Check Names.
    • Click on OK button (in the new window prompted by check names).
    • Again, click on OK button (in window where you entered SYSTEM).
    • Under Permissions for SYSTEM allow it Full Control.
    • Click on OK button (in window where you are giving permission).
    • Again, click on OK button.
    • Restart splunk
    • Enable the scripted input.

Uninstallation of App

This section provides the steps to uninstall App from a standalone Splunk platform installation.

  • (Optional) If you want to remove data from Splunk database, you can use the below Splunk CLI clean command to remove indexed data from an app before deleting the app.

    • $SPLUNK_HOME/bin/splunk clean eventdata -index <index_name>
  • Delete the app and its directory. The app and its directory are typically located in the folder$SPLUNK_HOME/etc/apps/<appname> or run the following command in the CLI:

    • $SPLUNK_HOME/bin/splunk remove app [appname] -auth <splunk username>:<splunk password>
  • You may need to remove user-specific directories created for your app by deleting any files found here: $SPLUNK_HOME/bin/etc/users/*/<appname>

  • Restart the Splunk platform.You can navigate to Settings -> Server controls and click the restart button in splunk web UI or use the following splunk CLI command to restart splunk:

    • $SPLUNK_HOME/bin/splunk restart

TEST YOUR INSTALL

  • Once Add-on app is configured to receive data from CNAE, The main app dashboard can take some time before the data is populated in all panels. A good test to see that you are receiving all of the data is to run this search after several minutes:

    index="[your index]" or "main" | stats count by sourcetype

In particular, you should see this sourcetype:
* cisco:candid:events

If you don't see these sourcetypes, have a look at the messages output by the scripted input: collect.py. Here is a sample search that will show them:

index=_internal component="ExecProcessor" collectCandid.py "CNAE Error:" | table _time host log_level message

Troubleshooting

  • Q. Fabric dropdown is not populating with Fabric Names.
  • Run below search in All Time to populate the lookup with all fabrics.

    sourcetype="cisco:candid:events" component=smart_event_details cnae_host= fab_id= | dedup fab_id | table cnae_host, fab_id, fabric_settings_dto.unique_name | rename cnae_host AS "NAE Host" fab_id AS "Fabric ID" fabric_settings_dto.unique_name AS "Unique Name" | inputlookup append=T FabricIdMapping | dedup "Fabric ID" | outputlookup FabricIdMapping

Additional Features

In addition to out-of-the-box reporting and analytics capabilities for your CNAE environment, the app includes a set of pre-defined dashboards for specific use cases:

  • Home: The starting reference with a high-level overall view of smart events and epochs.

  • Smart Event Statistics: Graphical representation of events that are New, Persisted, Unresolved and Resolved

  • Smart Event Summary: Information of events that are New, Persisted, Unresolved and Resolved based on filters like epochs, time-range, severity, etc.

  • Smart Event Analysis: Epoch Delta (changes of events between two epochs), Event Diff (Comparing two events based on hash-keys), Smart Event Lifecycle and User Assignment.

  • Search: Search smart events (search the smart events based on defined filters) and Search (search bar to view events ingested in Splunk).

  • Affected Object Analysis: Detailed analysis of affected objects (categorized per ACI constructs).

  • Work flow Action: The app provides a workflow actions "CNAE Event Details Viewer" and "Go to Smart Event Details" on the "Search Smart Events" and "Search" Dashboards that enables user to inspect an event in further detail

The list of open source components used in developing the App

Support

  • This app is supported by Cisco Systems.
  • Email support during weekday business hours. Please ask question or send an email to tac@cisco.com

Release Notes

  • Version 2.5.0:
  • Added two dashboards
    • Smart Event Lifecycle
    • User Assignment
  • Minor Bugfixes

  • Version 2.4.0:

  • Minor Bugfixes

  • Version 2.3.0:

  • Added support of Splunk 8.x

  • Version 2.2.0:

  • Minor Bugfixes

  • Version 2.1.0:

  • Fixed query for panel Informational Events single value

Release Notes

Version 2.5.0
Aug. 26, 2020
  • Added two new dashboards
    • Smart Event Lifecycle
    • User Assignment
  • Now Fabric Name will be populated on Fabric dropdown instead of IDs
Version 2.4.0
June 5, 2020

Minor bugfixes

Version 2.3.0
Jan. 28, 2020
  • Added support of Splunk 8.x
Version 2.2.0
Sept. 24, 2019

v2.2.0
* Minor Bugfixes

Version 2.1.0
May 2, 2019

Fixed query for panel Informational Events single value

Version 2.0.0
Nov. 30, 2018
  • New and Improved Dashboards
  • Workflow Actions: NAE UI Event Details Viewer & Smart Event Details Timeline
  • Affected Object Analysis
  • Epoch and Event Delta Analysis
  • Support Multiple NAE clusters
  • Support for NAE High Availability
Version 1.2.2
April 10, 2018

Version Release: 1.2.2

Version 1.2.1
March 30, 2018

ABOUT THIS APP

The Cisco Network Assurance Engine App (CNAE) for Splunk Enterprise is used to Build dashboard on indexed data provided by "Cisco Network Assurance Engine Add-on for Splunk Enterprise" app.

This app delivers centralized, real-time visibility for smart events from CNAE to analyze and inspect issues in your data center fabric along with historical correlations between events in epochs to show how a particular event behaves over time.

REQUIREMENTS

  • Splunk version supported 6.4 and above
  • This main App requires "Cisco NAE Add-on for Splunk Enterprise" version 1.1

Recommended System configuration

  • Splunk search head system should have 16 GB of RAM and a octa-core CPU to run this app smoothly.

Topology and Setting up Splunk Environment

Install main app (Cisco NAE App for Splunk Enterprise) and Add-on app (Cisco NAE Add-on for Splunk Enterprise) on a single machine.
Here both the app resides on a single machine.
Main app uses the data collected by Add-on app and builds dash

Version 1.2
March 30, 2018

ABOUT THIS APP

The Cisco Network Assurance Engine App (CNAE) for Splunk Enterprise is used to Build dashboard on indexed data provided by "Cisco Network Assurance Engine Add-on for Splunk Enterprise" app.

This app delivers centralized, real-time visibility for smart events from CNAE to analyze and inspect issues in your data center fabric along with historical correlations between events in epochs to show how a particular event behaves over time.

REQUIREMENTS

  • Splunk version supported 6.4 and above
  • This main App requires "Cisco NAE Add-on for Splunk Enterprise" version 1.1

Recommended System configuration

  • Splunk search head system should have 16 GB of RAM and a octa-core CPU to run this app smoothly.

Topology and Setting up Splunk Environment

Install main app (Cisco NAE App for Splunk Enterprise) and Add-on app (Cisco NAE Add-on for Splunk Enterprise) on a single machine.
Here both the app resides on a single machine.
Main app uses the data collected by Add-on app and builds dash

Version 1.1
Jan. 4, 2018
Version 1.0
Dec. 12, 2017

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.