Skip to main content
Lantern Home

 

Splunk Lantern

Correlating Webex and ThousandEyes data in the Splunk platform

  1. Last updated
  2. Save as PDF

The Webex Control Hub is a single pane of glass management platform for onboarding and managing users and devices, analytics, reports, and troubleshooting. It provides and end-to-end stitched view of the sequence of a Webex Calling call as it flows through different users (caller, callee) and entities (Hunt Groups, Auto attendants, Call Queues 
etc.). It also captures media quality data every minute and displays it using green (good), yellow (fair), or red (poor), based on the end to-end packet loss and average latency only. 

While the Control Hub is useful in itself, it is even more powerful when combined with ThousandEyes. ThousandEyes provides IT teams network visibility between user locations and Webex services to help teams rapidly identify problem domains (application, network, or third party). ThousandEyes deploys three types of agents that can get this Webex data.

  • Cloud: Hundreds around the world in ISP networks and in Webex data centers.
  • Enterprise: Enterprise Agents on customer routers, virtual machines, and more. 
  • Endpoint: Installed on Webex devices.
    • Supports UDP based tests
    • Supports unidirectional network tests
    • No support for advanced test cases such as DNS, HTTP Page load, API, RTP Tests Endpoint Agent
    • Unable to monitor QoS across each hop of the network
    • Only runs as long as endpoint is online

The endpoint agents are particularly helpful for running dynamic performance tests on the following services: 

  • Webex Meeting (Desktop, Webex Devices): Highly accurate, monitors path to media server (as seen in the packet captures)
  • Webex Calling (Desktop, Phones): Monitors path to STUN server
  • Third party (Zoom CRC, Teams VIMT): Limited visibility that terminates at some point on the Webex media node

However, when you end up with some data in ThousandEyes and some in Control Hub, correlating the information can be difficult. For example, network media quality metrics cannot be passed back to ControlHub from ThousandEyes. That's where the Splunk platform helps. 

How to use Splunk software for this use case 

There are three ways to get Webex and ThousandEyes data into the Splunk platform:

  • Webex Control Hub data, through the Webex Add-on for Splunk.
  • Device-level telemetry, sent natively from Cisco devices using the RoomOS xAPI HEC command.
  • ThousandEyes network and path data, through OpenTelemetry or HEC.

Integrating Webex data

There are two official add-ons between Webex and the Splunk platform. 

  • Webex Alert Action. This creates a bot that you add to Webex space. If it sees anomalies, it sends automated notifications to your collaborative Webex space so that your SOC and IT teams receive real time alerts from from Splunk searches and correlations.
  • Webex Add-on for Splunk. This read-only access add-on pulls data from the Webex REST API and brings it into the Splunk platform. 

We'll focus on the Webex Add-on for Splunk. 

  1. Download and install the TA.
  2. Configure Webex Integration with the correct scopes at developer.webex.com.
  3. Authenticate your Splunk add-on using the client ID and secret generated in Step 2.
  4. Configure inputs for all Webex operations you want to send to the Splunk platform.
    1. cisco:webex:meetings
    2. cisco:webex:meeting:usage:reports
    3. cisco:webex:meeting:attendee:reports
    4. cisco:webex:admin:audit:events
    5. cisco:webex:meeting:qualities
    6. cisco:webex:call:detailed_history
    7. cisco:webex:security:audit:events

The data you receive into the Splunk platform isn't always real time. It is subject to the same limitations as Control Hub. For example, there are certain logs you can only access four hours before and four hours after, and that won't change when you configure the add-on to access those inputs..

Exporting device telemetry natively

Cisco devices running RoomOS can send performance metrics directly to the Splunk platform using the native Telemetry Export Splunk HEC xAPI command. This gives you a device-side data source that you can correlate with your Control Hub and ThousandEyes data in the Splunk platform, including information on call quality, peripheral status, and network statistics from the device itself.

    Integrating ThousandEyes data

    There are three ways to get ThousandEyes data into the platform.

    The first option is to use a tool such as Postman or curl to create an OpenTelemetry stream between ThousandEyes and the Splunk platform. This approach requires no ThousandEyes UI interaction after initial setup and suits teams that prefer API-driven configuration. Run the following call once for each test you want to stream:

    POST https://api.thousandeyes.com/v7/stream
Content-Type: application/json

{
  "type": "splunk-hec",
  "endpointType": "http",
  "streamEndpointUrl": "https://<splunk-host>:8088/services/collector/event",
  "dataModelVersion": "v1",
  "customHeaders": [ { "token": "<HEC_TOKEN>" } ],
  "testMatch": [ { "id": "<TEST_ID>", "domain": "cea" } ],
  "enabled": true
}
    • Use "domain": "cea" for cloud and enterprise agent tests.
    • Use "domain": "epa" for endpoint agent tests.
    • Repeat the call for each ThousandEyes test ID you want to stream, substituting the numeric test ID in the testMatch array.

    Another option is the use the ThousandEyes interface and the HEC connector. This demo shows that process.

    The third option is the ThousandEyes App for Splunk, which collects the data and includes pre-built dashboards, so you do not need to build your own.

    Next steps

    Now that you have an idea of how you can use the Splunk platform to get more value out of your Webex and ThousandEyes data, watch the full talk from Cisco Live EMEA 2026, Webex Observability Made Simple with ThousandEyes and Splunk. In the talk, you'll learn more about about Webex observability with ThousandEyes, ThousandEyes agents, and ThousandEyes tests for Webex.

    Please note that the Splunk HEC macro shown in this session as a method for exporting device telemetry natively was an interim solution used before native support was added to RoomOS. Macros are not supported by Cisco, so you should use the xAPI command instead.

    You might also be interested in the following Splunk resources: