UniFi Network Add-on for Splunk

The UniFi Network Add-on for Splunk polls UniFi Network controllers via the Integration API v1 to collect network infrastructure inventory, telemetry, and reference data. The add-on retrieves configuration details for sites, devices, clients, networks, firewall policies, WiFi broadcasts, VPN servers, DNS policies, and hotspot vouchers. It also collects per-device performance statistics and large reference datasets such as country codes and DPI application classifications. All data is indexed into Splunk with structured source types that correspond to specific UniFi configuration objects and metrics. The add-on maps UniFi events and inventory to the Common Information Model (CIM) domains for Inventory, Network Traffic, Network Sessions, and Performance, enabling integration with Splunk Enterprise Security and IT Service Intelligence (ITSI). Dashboards provide visibility into client activity, network health, and device performance. API credentials are stored encrypted, and the add-on operates in read-only mode.