should servicenow discovery create an entry in cmdb_ci_appl or child table for splunk?

[Ravish Shetty]

Hi all,

Should ServiceNow discovery create an entry in cmdb_ci_appl or child table for Splunk if we do discovery on a Linux or Windows server which runs Splunk? 

At the moment, we don't see any entry created by discovery. it updates the server and related infrastructure tables.

we are not using service mapping.

Thanks,
Ravish

[Shubham_Jain]

@Ravish Shetty 

Out of the box, ServiceNow Discovery does NOT create entries in cmdb_ci_appl (Application CI table) for Splunk — unless you use:

1. Service Mapping, or
2. Custom horizontal pattern for Splunk recognition.

Customize Discovery Pattern for Splunk

• Extend an existing Application Pattern or create a Custom Horizontal Pattern.
• Look for splunkd, specific ports (8089, 8000), or file locations (/opt/splunk).
• Use pattern logic to insert into cmdb_ci_appl or child table (cmdb_ci_custom_app, etc.)