Skip to content

Configure inputs for the Splunk Add-on for Cisco Meraki

To configure inputs for the Splunk Add-on for Cisco Meraki, complete these steps:

  1. On Splunk Web, go to the Splunk Add-on for Cisco Meraki, either by clicking the name of this add-on on the left navigation banner or by going to Manage Apps, then clicking Launch App in the row for the Splunk Add-on for Meraki.
  2. Click the Inputs tab.
  3. Click Create new input.

  4. Fill in the required fields:

    Field Description
    Name A name for the new input.
    Organization The Cisco Meraki organization to collect data from.
    Start from Available only for “Audit” input and applicable only for the first time. Indicates the number of days in the past this add-on should get data from. If not set, default is 1.
    Interval How often, in seconds, the Splunk platform calls the API to collect data. Set to 360 seconds or above to avoid rate limiting errors.
    Index The index in which the Splunk platform stores events from Cisco Meraki. The default is main.

    Note

    When you enable the input for the first time, by default the add-on collects historical event data for 24 hours in the past. If you have configured a start time on the setup page (applicable only for “Audit” input) the add-on starts at the configured time.

  5. Once you are satisfied with the configurations, click Enable next to the inputs you want to enable.