Managing connections

You can view status, edit, import, and export connections.

View connection status

To view the status of your connections, go to the Connect Overview page, and scroll to the Connections section. A list of your connections displays with status information.

Click any connection to view or edit additional details for the connection, including statistics about the amount of data, connection runs, schedule, and logs for previous runs.

Filter connections list

If you have many connections, you can filter or order the list.

  • To filter on a specific connection, enter the connection name in the Filter by text field. The list updates with any connection names that contain the value you entered. To clear the filter, click X in the Filter by text field.
  • Click a column header to sort the connections by the data in the column in descending order. Click the column header again to sort the list in ascending order. To clear the sort, click the column header a third time.

View schedule for all connections

You can view the schedule for each connection in relation to all of the other connections.
From the Connect Overview page, scroll to the Connections section and click Schedule. The default view shows the connection runs for the current day, in the time zone of your browser.

  • To view details about a connection, click the connection name or click a run icon for the connection.
  • To view all of the connections that happened on a specific date, select the date in the calendar field above the schedule.
  • To filter the connections that display in the schedule, type a name into the Filter by name field. The list of connections automatically updates. To clear the filter, click X in the Filter by name field.

Change schedule time zone

To change the Default Workbench Time Zone, go to the Connect Overview page, click Settings , and open the Configuration tab.

View connection metrics

Use the charts in the Summary section to view overall connection metrics.

  • To track how many connections have run for each hour over the past seven days, use the Connection Runs Per Hour and Scheduled Connections Per Hour charts.
  • To track how much data is sent by all connections over the past seven days, use the Rows Sent Per Day and Bytes Sent Per Day charts.

Edit connections

To edit a connection, go to Modules > Connections, scroll to the Connections section, and click the connection. You can change the connection source, destination, filters, formats, and schedule in the configuration screen. You can reference the documentation for the particular destination type for more information.

Some destinations use specific destination names. When you edit a named destination, the changes affect all connections where that specific Destination Name is used.

Schedule connections

Schedule connections to run at specific time intervals. Then, you can view the schedule status of all of your connections in the schedule view.

Update a connection schedule

  1. Edit the connection.
    From the Connect Overview page, scroll to the Connections section, and click the connection.
  2. Use the Schedule section to update the schedule: 

    • Select Enable schedule.
    • In the Schedule Type, select Basic to build a schedule with the provided controls.
    • To view or edit the Cron expression directly, select Advanced - Define as a Cron Expression, and use the Advanced field to edit the Cron expression.
  3. Scroll to the bottom of the page and click Save.

Export connections

If you want to back up or move connections between environments, you can export a connection.

  1. From the Connect Overview page, scroll to the Connections section.
  2. Select the connections that you want to export, click Actions > Export, and confirm the export. The connections are saved to your download folder as a JSON file.

Import connections

You can import connections from JSON files that have been exported from the Connect 4 Workbench. You cannot import connections from Connect 3 or earlier.

  1. From the Connect Overview page, scroll to the Connections section.
  2. Click Import and then click Import File. Select the JSON file from which you want to import connections.
  3. Expand each row to review the messages for each connection that you are importing.

    You can filter the list of connections by the connection status, source, or destination.

  4. When you are ready to import one or more connections, select the connections and click Save.
  5. If any of the connections have errors or warnings, resolve the issues before you import the connection.
    1. Click the name of the connection that you want to import that has import errors.
    2. Edit the settings in the connection to resolve the issues.
    3. Click Import Connection.
  6. (Optional) If a connection is on the list that you do not want to import or review, select the connection and click Remove.

Use the same source for multiple destinations

For Event, Saved Question, and Tanium Data Service sources, you can send data from one source to multiple destinations by creating multiple connections that run at the same time, or within the question expiration period.

For example, you might want the output of a single saved question to send data to Splunk and also send an email. You can create two connections that both use the same source, but are each configured to use different destinations. If you configure both connections to run at the same time, or within the question expiration period, the environment is queried only once and the data is sent to both destinations.

For more information about the question expiration period, see Tanium Interact User Guide: Question expiration.

Use the same destination in multiple connections

You can reuse a destination in multiple connections. An existing destination is a specific instance of a destination that has specific details of the data target specified. These details vary for each destination type, but might include information such as the target IP address and port number, user name and password information, and destination paths.

After you create a destination, you can use the destination again in another connection.
To reuse a destination, choose an existing destination for the Destination Name.

For example, you might create a Splunk connection by setting the host name and port of the Splunk indexer and the format of the data to send. You can use this configured Splunk destination with multiple connections to send multiple data sources to your single Splunk configuration.

If you edit the settings for a shared destination for one connection, any other connections that use the shared destination are affected.

Clear New Items cache

If you are using the New Items filter, you can clear the new items cache in an existing connection.

  1. From the Connect Overview page, scroll to the Connections section, and click the connection.
  2. Expand the Configure Output > Filters section.
  3. Click Clear to remove all of the items in the baseline data. If you want to restart the learning period, enable Reset learning days.

Use REST APIs to manage connections

You can use the REST APIs for Connect to create, edit, and manage connections.

To view the Connect REST API documentation, navigate to the Connect Overview page, click Help , and click Connect API Documentation.

Configure notifications for failed connection runs

If you use the Connect > Failed Connection Run event group, you can choose to send a notification for a failed connection run.
This type of connection runs only once. If this connection fails, it does not reattempt the notification, so it prevents the connection from repeatedly running in the event that something in the connection is failing.