Hi @prachikomal ,

We can modify the time but keep in mind that it will impact the instance because logs are generated in huge numbers , but if this is fine for you , then you can go to sys_auto_flush table and there you can search for the syslog table and change the time from there change the age in seconds

Now coming to second question , Yes the logs are at instance level.

And coming to send the log to the Splunk you can you scripted rest API's and if you want to send only to splunk then ServiceNow has an app built and it is free of cost this will help in your case.
Store link : "https://store.servicenow.com/store/app/890cab2e1b246a50a85b16db234bcb17"

Useful article for choices of sending data from ServiceNow to other systems , link : "https://www.servicenow.com/community/servicenow-ai-platform-articles/data-integrations-from-and-to-s...

If this helped you please do mark it as helpful and accept the solution

Thanks,

Vishnu