icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.
Log4Shell Vulnerability: Information and guidance for you. Get resources.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Cisco Intersight Add-on for Splunk
SHA256 checksum (cisco-intersight-add-on-for-splunk_131.tgz) f3300b48df0cea4bcd85b043a4df9a5a1bd1a082bbfa6bac24baebec00c6c7bb
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate


Cisco Intersight Add-on for Splunk

Splunk Cloud
This app is NOT supported by Splunk. Please read about what that means for you here.
The Cisco Intersight Add-on for Splunk (TA-intersight-addon) provides a python-based scripted input to retrieve data from Cisco Intersight. SaaS, Connected Virtual Appliance, and Private Virtual Appliance deployments of Intersight are all supported.

Data that can be imported from Intersight includes Audit Logs, Alarms, Advisories, as well as a variety of Inventory records. Click Details for more information.

Further documentation, sample searches, and known issues are all available at the Github repository.


This Add-on is community developed and is not supported by Cisco Systems or the Cisco Technical Assistance Center (TAC).


The Add-on leverages the Cisco Intersight RESTful API to retrieve various kinds of data. Multiple inputs for different Intersight accounts/appliances are configurable and each account/appliance can optionally retrieve the following data types. Events are in JSON format.

New Inventory types are not automatically added to existing configurations. Please review your input configurations after upgrading to enable the new options.

Option Intersight API Splunk sourcetype
AAA Audit Records aaa/AuditRecords cisco:intersight:aaaAuditRecords
Alarms cond/Alarms cisco:intersight:condAlarms
Advisories tam/AdvisoryInstances cisco:intersight:tamAdvisoryInstances
Compute compute/PhysicalSummaries cisco:intersight:computePhysicalSummaries
Compute equipment/Chasses cisco:intersight:equipmentChassis
Compute cond/HclStatuses cisco:intersight:condHclStatuses
Contract asset/DeviceContractStatusInformations cisco:intersight:assetDeviceContractInformations
Hitachi storage/HitachiArrays cisco:intersight:storageHitachiClusters
Hitachi storage/HitachiControllers cisco:intersight:storageHitachiControllers
Hitachi storage/HitachiVolumes cisco:intersight:storageHitachiVolumes
Hyperflex hyperflex/Clusters cisco:intersight:hyperflexClusters
Hyperflex hyperflex/Nodes cisco:intersight:hyperflexNodes
Hyperflex hyperflex/StorageContainers cisco:intersight:hyperflexStorageContainers
Hyperflex hyperflex/Licenses cisco"intersight:hyperflexLicenses
Licensing License/AccountLicenseData cisco:intersight:licenseAccountLicenseData
Licensing license/LicenseInfos cisco:intersight:licenseLicenseInfos
NetApp storage/NetAppClusters cisco:intersight:storageNetAppClusters
NetApp storage/NetAppNodes cisco:intersight:storageNetAppNodes
NetApp storage/NetAppStorageVms cisco:intersight:storageNetAppStorageVms
NetApp storage/NetAppVolumes cisco:intersight:storageNetAppVolumes
NetApp convergedinfra/Pods cisco:intersight:convergedinfraPods
Network network/ElementSummaries cisco:intersight:networkElementSummaries
Pure storage/PureArrays cisco:intersight:storagePureArrays
Pure storage/PureControllers cisco:intersight:storagePureControllers
Pure storage/PureVolumes cisco:intersight:storagePureVolumes
Target asset/Targets cisco:intersight:assetTargets

Further documentation, sample searches, and known issues are all available at the Github repository.

This Add-on is community developed and is not supported by Cisco Systems or the Cisco Technical Assistance Center (TAC).

Release Notes

Version 1.3.1
Aug. 3, 2022
  • Found a serious bug in checkpointing that might cause Audit Logs and Alerts to never be retrieved for an input
  • Additional pruning for cisco:intersight:computePhysicalSummaries and a few other items
  • Added cisco:intersight:equipmentChassis to Compute inventory

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.