Integration with Splunk

[Rakshanda Kunte]

Hi All,

Users in the Splunk team have a table in ServiceNow that shows Splunk indexes and their ownership.

This table is static and has to be manually updated when splunk team create new indexes.
they would like it to be dynamically updated from Splunk, most feasible solution is via REST API.

Can anyone please guide steps how to achieve this?

Thanks.

[Rakshanda Kunte]

@Eshwar Reddy ,

Here, the table already exists in servicenow.

So, I guess we should use table api. 

I am implementing this first time. Kindly, suggest.

Thanks.

[Eshwar Reddy]

@Rakshanda Kunte 

Its not good practice to use Table API -->The Table API allows direct access to create, update, and delete records, which can lead to unauthorized data manipulation if not properly controlled.

I would suggest Import Set API(low code) or Scripted Rest API
 

[Omkar Mone]

Hello Rakshanda,

You can create a Scripted REST API in ServiceNow and share the details with the Splunk team. The Splunk team will need to configure this API in their environment to send data to ServiceNow.

Once Splunk calls the API, you'll need to write a script to process the incoming data and transfer it to the appropriate table in ServiceNow.

For guidance on creating a Scripted REST API, please refer to this documentation:
ServiceNow Scripted REST API Documentation.

Feel free to reach out if you need assistance with scripting once the data arrives in ServiceNow.

Note: Ensure that Splunk can connect to ServiceNow. If there are connection issues, you may need your Infrastructure team to whitelist the ServiceNow URL.

Let me know if you have any questions!