Cisco Meraki Add-on for Splunk

Cross-Organization Visibility

• Unified view across multiple Meraki organizations
• Comparative analytics across different networks
• Standardized monitoring for diverse deployments
• Perfect for:
  • Service providers supporting multiple customer organizations
  • Enterprises with multiple organizational divisions
  • Global companies with regional organizations

Enhanced Historical Analysis

• Extended historical data retention and analytics
• Long-term trend analysis across organizations
• Advanced capacity planning capabilities
• Flexible data retention options

Unified Security Monitoring

• Centralized security event management
• Cross-organization threat correlation
• Comprehensive configuration tracking
• Streamlined compliance monitoring

Cross-Platform Integration

• Seamless integration with other Cisco security products
• Native Splunk Enterprise Security compatibility
• Unified network and security event correlation
• Customizable security dashboards

Distributed Installation Requirements

Distributed Features Support

• Search Head Clusters: Supported
• Indexer Clusters: Supported
• Deployment Server: Limited support (unconfigured add-on only)

API Key

Generate your API key in the Meraki Dashboard

• Navigate to Organization > API & Webhooks
• Generate a new API key
• Save the API key securely - it will only be shown once

Organization ID

Obtain your organization ID using one of these methods:

 [
     {
         "id": "876128346",
         "name": "My Meraki Org",
         ...

curl -L --request GET \
--url https://api.meraki.com/api/v1/organizations \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer [API Key]'

Device Configuration

For optimal data collection and analysis:

• Name all devices (access points, cameras, security appliances, switches) in the Meraki Dashboard
• Device names can be set in each device's overview page in the Meraki Dashboard
• Consistent naming conventions improve searchability and reporting

(Optional) Change logging level

1. On Splunk Web, go to the Splunk Add-on for Cisco Meraki, either by clicking the name of this add-on on the left navigation banner or by going to Manage Apps, then clicking Launch App in the row for the Splunk Add-on for Cisco Meraki.
2. Click the Configuration tab.
3. Click the Logging tab.
4. Select a new logging level from the drop-down menu.
5. Click Save to save your configurations.

(Optional) Proxy setup

1. On Splunk Web, go to the Splunk Add-on for Cisco Meraki, either by clicking the name of this add-on on the left navigation banner or by going to Manage Apps, then clicking Launch App in the row for the Splunk Add-on for Cisco Meraki.
2. Click the Configuration tab.
3. Click the Proxy tab.
4. Check Enable and fill in the required fields.

Manage Inputs

To Disable an Input

1. Go to Cisco Meraki Add-on for Splunk > Inputs
2. Find the input you want to Disable from the list of inputs
3. Click on Status > Enabled

To Enable an Input

1. Go to Cisco Meraki Add-on for Splunk > Inputs
2. Find the input you want to Enable from the list of inputs
3. Click on Status > Disabled

To Edit an Input

1. Go to Cisco Meraki Add-on for Splunk > Inputs
2. Find the Input you want to edit from the list of configured inputs
3. Click on Action > Edit
4. Update the required parameters in the dialogue box
5. Click on Update

To Clone or Delete an Input

1. Go to Cisco Meraki Add-on for Splunk > Inputs
2. Click Action > Clone/Delete

Pre-upgrade Steps

1. Document your existing configuration
2. Disable all inputs linked to your configured accounts
3. Back up any custom dashboards or saved searches

Post-upgrade Configuration

After upgrading to version 3.0.0, follow these steps for each existing account:

1. Navigate to the Configuration page in the Splunk Add-on for Cisco Meraki

2. For each existing account:

   • Click the Edit icon for the configured account
   • Re-enter the Organization API Key
   • Review and adjust the Max API Calls per Second setting if needed
   • Save the changes

3. Re-enable your inputs after completing the account updates

Important Note: Attempting to use accounts configured in version 2.2.1 without performing these steps after upgrading to version 3.0.0 will result in errors. 

Upgrading directly to version 3.0.1 does not require any additional steps.

Verification Steps

After completing the upgrade process:

1. Verify data collection has resumed
2. Check for any error messages in the logs
3. Confirm all dashboards and saved searches are functioning correctly

Generate a HEC token

1. Log in to Your Splunk Instance

2. Navigate to Cisco Meraki Add-on for Splunk.

3. Navigate to the HTTP Event Collector Configuration

   • In the top-right corner, go to Settings
   • Select Data Inputs > HTTP Event Collector

4. Verify HTTP Event Collector is Enabled

   • Click on the Global Settings button in the top-right corner
   • In the Global Settings window:
     • Ensure All Tokens are set to Enabled
     • Specify the HTTP Port Number (default: 8088) or retain the existing port configuration
   • Save the changes to return to the HTTP Event Collector page

5. Create a New HEC Token

   • Click the New Token button in the top-right corner

6. Configure the Token

   • Selected Source:
     • Provide a descriptive name for the HEC token and click Next
   • Input Settings:
     • Set the Sourcetype to Select and select "meraki:webhook" sourcetype
     • Select an Index from the available list where the data will be ingested (Note: You can create and assign a new index if needed.)

7. Review and Submit

   • Click the Review button to verify the token configuration details
   • If all details are correct, click Submit to create the token
   • After submission, a new page will display the Token Value

Create a Webhook Template

Before creating a receiver, create a new Splunk template to format and send the data

• Click on Templates
• In the Templates tab, click the New Template button

1. Define the Template

   • Enter a unique Name, such as "Splunk"
   • Define the Liquid Body by entering the following schema:

{
  "sourcetype": "meraki:webhook",
  "event": {
    "version": "0.1",
    "sentAt": "{{sentAt}}",
    "organizationId": "{{organizationId}}",
    "organizationName": "{{organizationName}}",
    "organizationUrl": "{{organizationUrl}}",
    "networkId": "{{networkId}}",
    "networkName": "{{networkName}}",
    "networkUrl": "{{networkUrl}}",
    "networkTags": {{ networkTags | jsonify }},
    "deviceSerial": "{{deviceSerial}}",
    "deviceMac": "{{deviceMac}}",
    "deviceName": "{{deviceName}}",
    "deviceUrl": "{{deviceUrl}}",
    "deviceTags": {{ deviceTags | jsonify }},
    "deviceModel": "{{deviceModel}}",
    "alertId": "{{alertId}}",
    "alertType": "{{alertType}}",
    "alertTypeId": "{{alertTypeId}}",
    "alertLevel": "{{alertLevel}}",
    "occurredAt": "{{occurredAt}}",
    "alertData": {{ alertData | jsonify }}
  }
}

5. Define the Liquid Header
   • Navigate to the Liquid Header section
   • Click on Add and provide:
     • Key: Authorization
     • Value: Splunk {{sharedSecret}}

Create a Webhook Receiver

• Open the Receivers tab
• Enter the following details:
  • Name: Enter name for the webhook receiver
  • URL: Enter the Splunk receiver URL
    • Format: https://{{ip/instance name}}:{{HEC Port}}/services/collector/event
    • Example: https://abcanc.io:1234/services/collector/event
  • Shared Secret: Use the Splunk HEC token
  • Payload Template: Use the Splunk template created above

On Meraki Platform

1. Navigate to Network-Wide > Alerts
2. Scroll to the webhooks section
3. Find your webhook and click Test webhook
4. A green "Delivered" message indicates success

On Splunk Platform

1. Navigate to Cisco Meraki Add-on for Splunk > Search
2. Enter the search query:

   index=<WEBHOOK_INDEX> sourcetype="meraki:webhook"
   

   Replace WEBHOOK_INDEX with your configured index name
3. View the collected data in the search results

Configuring Macros

You can modify macros in Splunk by following these steps:

1. Navigate to Settings > Advanced Search > Search macros

   
   

2. Once the macros page opens:

   • Go to the apps dropdown
   • Select "Cisco Meraki Add-on for Splunk"
   • This shows the list of macros created for Cisco Meraki
   

3. To edit a macro:

   • Click on the name of the macro to open the editing window
   • If you have a separate index for your data collection, you can update the macro definition to add support for that index
   • By default the supported index is main
   • To add more indexes, add a comma(,) and the index name you want to add

Example:

index IN( main , test_index )

Input Patterns

The inputs have common configuration patterns as described below:

API Connectivity

1. Verify API key access:

   curl -L -X GET \
   'https://api.meraki.com/api/v1/organizations' \
   -H 'Authorization: Bearer YOUR_API_KEY'
   

   • Should return a list of organizations
   • If 404: Check API key permissions
   • If 403: Verify API access is enabled for the organization

2. Verify organization ID access:

   curl -L -X GET \
   'https://api.meraki.com/api/v1/organizations/YOUR_ORG_ID' \
   -H 'Authorization: Bearer YOUR_API_KEY'
   

   • Should return organization details
   • If error: Verify API key has access to the organization

App Installation

1. Check app logs:

   • Location: $SPLUNK_HOME/var/log/Splunk/splunk_ta_cisco_meraki*.log
   • Search in Splunk: index="_internal" source=*splunk_ta_cisco_meraki*.log*
   • For errors only: index="_internal" source=*splunk_ta_cisco_meraki*.log* ERROR

2. Verify KV Store:

   • Must be enabled, especially on Heavy Forwarders
   • Check Settings > Server Settings > KV Store

No Data Coming In

1. Check API key permissions
2. Verify organization ID
3. Check input status in Splunk Web
4. Look for errors in input logs

Rate Limiting (429 Errors)

1. Check input logs for "429" errors
2. Reduce API calls per second in input configuration

Webhook Issues

1. Verify HEC token is enabled
2. Check webhook URL is accessible
3. Confirm webhook template in Meraki Dashboard

Data Collection

• 429 Errors: "Max API calls limit reached"

  • Wait before retrying
  • Adjust API call rate for the organization in the add-on Configuration section
  • Restart the input

• Authentication Errors:

  • Verify API key has at least read permissions to the Meraki organization
  • Check if the organization ID is correct