Managing connections

You can view status, edit, import, and export connections.

View connection status

To view the status of your connections, choose one of the following options:

  • Go to the Connect Overview page, and scroll to the Connections section.
  • From the Connect menu, click Connections.

A list of your connections displays with status information.

  • Click to expand any row to show additional details for the connection, include owner, source, and schedule.
  • Click any connection to view details for the connection, including statistics about the amount of data, connection runs, schedule, and logs for previous runs.

The Connections section also has a dedicated page. To access, click Connections from the Connect menu.

Filter connections list

If you have many connections, you can filter or order the list.

  • To filter on a specific connection, enter the connection name in the Filter by text field. The list updates with any connection names that contain the value you entered. To clear the filter, click X in the Filter by text field.
  • Click a column header to sort the connections by the data in the column in descending order. Click the column header again to sort the list in ascending order. To clear the sort, click the column header a third time.

View schedule for all connections

You can view the schedule for each connection in relation to all of the other connections.
From the Connect Overview page, scroll to the Connections section and click Schedule. The default view shows the connection runs for the current day, in the time zone of your browser.

  • To view details about a connection, click the connection name or click a run icon for the connection. If the run icon is for a failed run, click the run icon to open the specific run log.
  • To view all of the connections that happened on a specific date, select the date in the calendar field above the schedule.
  • To filter the connections that display in the schedule, type a name into the Filter by name field. The list of connections automatically updates. To clear the filter, click X in the Filter by name field.
  • To view the run log for a specific connection run, click the run icon in the schedule.

Change schedule time zone

To change the Default Workbench Time Zone, go to the Connect Overview page, click Settings , and open the Configuration tab.

View connection metrics

Use the charts in the Summary section to view overall connection metrics.

  • To track how many connections have run for each hour over the past seven days, use the Connection Runs Per Hour and Scheduled Connections Per Hour charts.
  • To track how much data is sent by all connections over the past seven days, use the Rows Sent Per Day and Bytes Sent Per Day charts.

Edit connections

To edit a connection, go to Modules > Connect, scroll to the Connections section, click the connection, and click Edit. You can change the connection source, destination, filters, formats, and schedule in the configuration screen. You can reference the documentation for the particular destination type for more information.

  • Some destinations use specific destination names. When you edit a named destination, the changes affect all connections where that specific Destination Name is used.
  • Some connections use passwords for the destination. If you change settings for a destination, you must re-enter the password.

Schedule connections

Schedule connections to run at specific time intervals. Then, you can view the schedule status of all of your connections in the schedule view.

Update a connection schedule

  1. Edit the connection.
    From the Connect Overview page, scroll to the Connections section, and click the connection.
  2. Use the Schedule section to update the schedule:

    • Select Enable schedule.
    • In the Schedule Type, select Basic to build a schedule with the provided controls.
    • To view or edit the Cron expression directly, select Advanced - Define as a Cron Expression, and use the Advanced field to edit the Cron expression.

    If a user that owns a scheduled connection is deleted, future scheduled instances of that connection do not run. For more information, see Problem: Scheduled connection owned by a deleted user no longer runs.
  3. Scroll to the bottom of the page and click Save.

Run connections

In addition to scheduling a connection, you can manually run a connection. There are multiple options throughout Connect to manually run a connection:

  • From the Connect Overview page, scroll to the Connections section, select the checkbox next to the connection, and click Run Now.
  • From the Connect menu, click Connections to open the Connections page. Select the checkbox next to the connection, and click Run Now.
  • From either the Connect Overview page or the Connections page, click the connection to view details for the connection. From this page, click Run.
  • When you edit a connection, click Run at the top of the page to run the connection. Note that if you click Run, any changes you made are not saved. If you make changes to the connection and want to run the connection with the updated settings, scroll to the bottom of the page and click Save and Run.

If a connection is already running, the option to run the connection is replaced with a Stop button.

Manage connection limits

Connect contains options to limit the CPU and memory resources that are available for connections. Connect settings are available in the Configuration tab of the Settings page.

  • Use the Memory Ceiling option to set a maximum sum of memory (GB) for all simultaneously running connections.
  • Use the Process Count Limit option to limit the number of connections that can run simultaneously.

If you update these settings, make sure the settings account for how much average and maximum data is sent on the connection runs. For example, if Process Count Limit is set to 4 and Memory Ceiling is set to 8 GB, the maximum average data available per connection is 2 GB. If your connections send an average of 4 GB for each connection run, and the Process Count Limit is set to 4, then the default Memory Ceiling setting of 8 GB is not enough to simultaneously run four connections in your environment. In this case, you can increase the Memory Ceiling to 16 GB, decrease the Process Count Limit to 2, or reschedule connections to reduce the number of simultaneously running connections.

For more information on Connect settings, see Installing Tanium Connect.

When scheduling connections, you should stagger connection start times to reduce the number of connections that run simultaneously. For information on how to see the schedule for all connections, see View schedule for all connections.

Export connections

If you want to back up or move connections between environments, you can export a connection.

  1. From the Connect Overview page, scroll to the Connections section.
  2. Select the connections that you want to export, click Actions > Export, and confirm the export. The connections are saved to your download folder as a JSON file.

Import connections

You can import connections from JSON files that have been exported from the Connect 4 Workbench. You cannot import connections from Connect 3 or earlier.

  1. From the Connect Overview page, scroll to the Connections section.
  2. Click Import and then click Import File. Select the JSON file from which you want to import connections.
  3. Expand each row to review the messages for each connection that you are importing.

    You can filter the list of connections by the connection status, source, or destination.

  4. When you are ready to import one or more connections, select the connections and click Save.
  5. If any of the connections have errors or warnings, resolve the issues before you import the connection.
    1. Click the name of the connection that you want to import that has import errors.
    2. Edit the settings in the connection to resolve the issues.
    3. Click Import Connection.
  6. (Optional) If a connection is on the list that you do not want to import or review, select the connection and click Remove.

Use the same source for multiple destinations

For Event, Saved Question, and Tanium Data Service sources, you can send data from one source to multiple destinations by creating multiple connections that run at the same time, or within the question expiration period.

For example, you might want the output of a single saved question to send data to Splunk and also send an email. You can create two connections that both use the same source, but are each configured to use different destinations. If you configure both connections to run at the same time, or within the question expiration period, the environment is queried only once and the data is sent to both destinations.

For more information about the question expiration period, see Tanium Console User Guide: Question expiration.

Use the same destination in multiple connections

You can reuse a destination in multiple connections. An existing destination is a specific instance of a destination that has specific details of the data target specified. These details vary for each destination type, but might include information such as the target IP address and port number, user name and password information, and destination paths.

After you create a destination, you can use the destination again in another connection.
To reuse a destination, choose an existing destination for the Destination Name.

For example, you might create a Splunk connection by setting the host name and port of the Splunk indexer and the format of the data to send. You can use this configured Splunk destination with multiple connections to send multiple data sources to your single Splunk configuration.

If you edit the settings for a shared destination for one connection, any other connections that use the shared destination are affected. Alternatively, you can select an existing destination and rename the Destination Name to create a new destination.

Clear New Items cache

If you are using the New Items filter, you can clear the new items cache in an existing connection.

  1. From the Connect Overview page, scroll to the Connections section, and click the connection.
  2. Click Edit.
  3. Expand the Configure Output > Filters > Learning Settings section.
  4. Click Clear Learned Items Cache and then click Confirm to remove all of the items in the baseline data. To remove all items in the baseline data and restart the learning period, click Restart learning.

Use REST APIs to manage connections

You can use the REST APIs for Connect to create, edit, and manage connections.

To view the Connect REST API documentation, navigate to the Connect Overview page, click Help , and click Connect API Documentation.

Configure notifications for failed connection runs

If you use the Connect > Failed Connection Run event group, you can choose to send a notification for a failed connection run.
This type of connection runs only once. If this connection fails, it does not reattempt the notification, so it prevents the connection from repeatedly running in the event that something in the connection is failing.