SNow-Splunk ES integration

[Paolo6]

Hi all, I'm trying to integrate Splunk ES with Servicenow.

The objective is to let Splunk ES open SIR on SNow and, when the SIR is closed, let it know to Splunk ES.

I'm basically following this guide: https://docs.servicenow.com/bundle/orlando-security-management/page/product/secops-integration-splunk-event-ingest/concept/splunk-event-ingest-overview-security.html

We have an on prem Splunk ES instance and the configuration through the mid-server went well (I successfully created a Splunk Enterprise Security - Event Ingestion" security integration).

I configured an event profile to test the integration (https://docs.servicenow.com/bundle/orlando-security-management/page/product/secops-integration-splunk-event-ingest/task/splunk-event-ingest-create-profile-security.html#splunk-create-profile-security), but at the step "Mapping notable event fields for the Splunk Enterprise Security integration" when I click on "Fetch Sample Data" an error is returned: "error while fetching sample events".

I can't find any log in "System logs" to understand the cause of this error. Where can I find more info about this event?

I'm wondering also if privileges assigned to the Splunk account are corrects. I can't find any requirement about that. Any suggestion?

Thank you.

Paolo

[Paolo6]

Hi camran,

I mentioned the Mid Server because our Splunk was on-premise, not exposed to the internet, so SN can't call the Splunk APIs.

I think that if you have Splunk Cloud you don't need a mid server.

Paolo