Creating a unified view of your network service health
Monitoring in most network and IT operating centers is complex due to tool sprawl. Analysts face issues with establishing business context, event correlation, and proactive posture against issues. The explosion of alerts in the last five years is overwhelming and, if your organization is like others, you might see downtime cost $365k in lost revenue per hour, averaging 240 hours a year.
Splunk IT Service Intelligence, a premium app that sits on top of the Splunk platform, helps you create a unified view of your network service health. It is vendor-agnostic software that brings in data from domains you monitor and from third-party tools outside your ecosystem to build cross-domain data correlations and insights for faster root cause analysis (RCA). It can also help you detect anomalies and predict issues up to 30 minutes in advance to help prevent outages.
This article shows how Splunk IT Service Intelligence (ITSI) accomplishes these goals in the context of a variety of Cisco monitoring tools. The same processes can be applied to dozens of other vendors.
How to use Splunk software for this use case
The Splunk platform offers easy data integrations from Cisco monitoring tools. Bringing in your Cisco data through these add-ons provides all the following benefits:
- Cisco ThousandEyes App for Splunk. Enterprise networks and app synthetics. Correlate user experience degradation and application performance issues to the underlying network infrastructure for accelerated root cause analysis.
- Out of the box alert templates and correlations by source and alert type
- ThousandEyes tests categorized as Network Services, DNS, Network Layer, Web Layer, and Routing
- Dynamically correlation of ThousandEyes KPIs that contribute to service health and map to tests (entities)
- Visualization of vital metrics by ThousandEyes agent location in ITSI Entity overview dashboards
- Deep link troubleshooting and in-context drill-down
- Cisco Catalyst Add-on for Splunk. Wired and wireless across branch and campus. Quickly pinpoint site and device issues in the network with:
- Site-based dependency mapping dynamically derived from Catalyst device “Site” tags
- KPIs and entity models to measure site health, including core, distribution, access, and wireless
- “One click” alert onboarding, deduplication and correlation
- Health visualization of site floors or localized areas to pinpoint unhealthy devices
- In-context drill-downs into Catalyst Center Assurance to perform RCA
- Cisco Meraki Add-on for Splunk. Wired and wireless as a cloud service. Quickly pinpoint site and device issues in the network with:
- Dynamic service topology by region and tags
- KPIs and entity models to measure health of network configuration, connectivity, device health, and insights issues
- ”One click” alert onboarding, normalization, deduplication, and correlation
- Insights into networks to identify cause of alerts
- In-context drill-downs into Meraki to perform RCA
- Cisco DC Networking. Data center networks. Quickly pinpoint data center issues with:
- Dynamic service topology by fabrics
- KPIs and entity models to measure health of data center connectivity, capacity, and hardware anomalies
- ”One click” alert onboarding, normalization, deduplication, and correlation
- Insights into Nexus data center to identify cause of anomalies represented as actionable alerts
The following demo shows an example of the data that is brought into the Splunk platform.
For non-Cisco data sources, explore Splunkbase to find additional add-ons.
Our main use case for bringing all this separate data into Splunk IT Service Intelligence is network event correlation, which might mean any of the following:
- Deduplication / suppression of alerts (including SNMP traps)
- Same alert coming from the same network device
- Same alert coming from multiple network devices
- Multiple alerts from the same device
- Trap or alert storm detection and suppression of noisy sources or traps
- Automated up/down alert correlations
- Detecting flapping interfaces via up/down alert patterns
- Parent-child alert correlations
- Sub-interface alerts under physical interface alerts
- Network device to NIC alert correlations
- Topology-based alert correlations
Let's look at a quick demo of event correlation in action.
Beyond basic event correlations, Splunk IT Service Intelligence enriches episodes by linking them to entities and services. The Service Analyzer tree view can help with proactive outage prevention for networks by predicting service health degradation and hence a potential incident 30 minutes in advance. In other words, you can use it to help determine if there is a possible outage about to happen in the data center based on a downward trend in network throughout. Let's watch how that works with a variety of Cisco data sources.
Finally, you don't have to bring all your data into Splunk IT Service Intelligence. From the Service Analyzer tree view, you can go back out to your other platforms, like Nexus Dashboard, to drill down into issues after you've identified them. Let's watch.
Additional resources
Now that you have an idea of the power of bringing your fragmented network data into Splunk IT Service Intelligence, watch the full talk from Cisco Live EMEA 2026, Splunk Observability: A Unified Solution for End-to-End Visibility and Troubleshooting Across Applications, Infrastructure and Networks. In the talk, you'll learn more about working with the add-ons, discover additional Network AIOps use cases with Splunk IT Service Intelligence, and preview some roadmap items that will continue to improve these integrations.