This is a Stateful App for sending log information from APIC to SPLUNK Indexer

1. https to be enabled for the POD on APIC
Fabric->Fabric Policies->Pod Policies->Policies->Management Access->default
Admin State: Enabled

2. Splunk Enterprise with Cisco ACI App
This app needs Cisco ACI App to be installed on Splunk instance
Download the app from:

3. Timestamp is in sync between APIC and Splunk Enterprise

Key Features:

• Overall fabric health score monitoring

• Top affected tenants, their health score and faults with the drilldown capability to look into fault descriptions and recommended actions.

• Top affected spines and leafs, their health score and faults with the drilldown capability to look into their physical components e.g. chassis, fan tray, power supply, supervisor etc.

• Trending of faults over time, by cause and by impacted assets

• Threshold setting for KPI's (e.g tenants, end point groups, contracts, filters, bridge domains and l3out networks) and generate alerts when threshold exceeds warning/critical limits

• Provides Top TCAM percentage used nodes and Port utilization of leafs and spines. Also provides tenant-based utilization report for bandwidth consumed

• Authentication tracking

• Ability to correlate ACI compute and storage data with data collected by Splunk app for VMware


1. Open CiscoSplunkConnector in installed apps tab

2. Enter Splunk Applicance IP Address:

3. Active Port Number:
This can be found on Splunk Enterprise under
Settings->Forwarding and receiving->Receive data:
< #Listen on this port >

More Info


Opens the graphql endpoint



Permissions Level


Developer contact

Submit a Review

{{300 - reviewText.length}}
Review can't be empty
Review can have maximum of 300 characters