How to Send ServiceNow Logs to External System (Cribl)

[Priya Singh9]

Hello Everyone,

We have a requirement to send ServiceNow logs to Cribl. I am doing a feasibility check to understand whether ServiceNow platform logs can be forwarded from ServiceNow to Cribl.

Specifically, I am looking to understand:
• Has anyone successfully forwarded ServiceNow logs to Cribl Stream?
• Is the recommended approach to use Syslog Probe via MID Server, REST APIs, or another supported mechanism?
• Are there any limitations or best practices when integrating ServiceNow with Cribl for log ingestion?
Any real time experience, documentation references, or guidance would be greatly appreciated.

Thanks in advance!

[SumanthDosapati]

@Priya Singh9 

This attached document covers step to step instruction to use ServiceNow REST APIs to collect data from any table using Cribl collector.

However, be careful when doing with logs table as it is huge and can impact performance.

Accept the solution and mark as helpful if it does, to benefit future readers.
Regards,
Sumanth

[Priya Singh9]

Hi Sumanth,

Thanks for the response. I have reviewed the documentation you shared; however, it primarily focuses on collecting data via ServiceNow REST APIs.

Our current evaluation is specifically around using the native Syslog Probe (via MID Server) to forward ServiceNow security and system logs to an external platform like Cribl. The document doesn’t seem to cover this Syslog-based approach.

Could you please share any insights or references related to using the Syslog Probe for log forwarding?

Thank you.

[SumanthDosapati]

Haven't exactly integrated with Cribl using Syslog probe but the basic prerequisite and process for using syslog probe is same for all the external systems. i.e by calling Syslog script include.

Just sharing some link that might help you.

Regards,
Sumanth