--- sourceDocument: Australia IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Splunk Poller # Splunk Poller integration configuration fields {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Splunk Poller integration configuration fields This document describes the configuration fields required to set up the Splunk Poller integration for Health Log Analytics in ServiceNow Australia release. It provides detailed explanations of each form field to help you correctly configure the integration that pulls log data from Splunk into your ServiceNow instance. Show full answer Show less ## Key Configuration Fields * **Integration Name:** A unique, required name for the integration which auto-updates the generic form name. * **Execute on:** Choose to use either a specific MID Server or a MID Server cluster to pull log data. * **MID Server:** If "Specific MID Server" is selected, specify a MID Server that supports basic authentication (not mTLS). The default limit is 10 concurrent data inputs per MID Server, adjustable in MID Server properties. Log ingestion is enabled automatically if not already set. * **MID Server Cluster:** If a cluster is chosen, only failover MID Server clusters are supported, ensuring high availability by switching to another server if one fails. Each MID Server in the cluster must have log ingestion enabled, which Health Log Analytics enables if missing. Capacity validation requires at least one MID Server with fewer than 10 running data inputs. * **Service Instance:** Required field to bind the incoming log data to a specific ServiceNow service instance (application service). * **Data Source:** Read-only field indicating Splunk as the log data source. * **Description:** Optional field for adding a brief note about the integration. ## Data Retrieval Settings * **REST API Server URL:** Required URL to access the Splunk REST API, typically on port 8089 (e.g., http://\:8089). Note that this is distinct from the Splunk front-end URL. * **Authentication Method:** Required credential alias to authenticate with Splunk. The integration uses credential aliases for basic or token authentication. You can manage or create aliases in the Connection \& Credential Aliases list. * **Query:** A required Splunk search query to specify which logs to retrieve (e.g., sourcetype="adcaccesslog"). ## Advanced Settings * **Max documents per query:** Sets the maximum number of log documents retrieved per query; default is 10,000. * **Splunk Request Timeout (seconds):** Sets the maximum time allowed for each data retrieval request before timeout. ## Practical Implications for ServiceNow Customers This configuration allows you to reliably and efficiently ingest log data from Splunk into ServiceNow's Health Log Analytics. Proper selection and setup of MID Servers or clusters ensure availability and performance. Using credential aliases secures authentication management. Setting appropriate query parameters and advanced options optimizes data retrieval tailored to your needs. Description of the fields on the Splunk Poller integration configuration forms for Health Log Analytics. For the Splunk Poller integration setup procedure, see [Set up a Splunk Poller integration for Health Log Analytics](https://www.servicenow.com/docs/cgRIEDTNjxgBUIP1arRARQ "Set up an integration that periodically pulls log data from Splunk to your ServiceNow instance for processing by Health Log Analytics."). {#il-connector-hla-splunkpoll-fields__table_fhy_yq1_m2c__entry__2} | Field | Description | |-|-| | Integration Name | Unique name of this integration. This field is required. Note: When you fill in this field, the generic name displayed on the form adjusts automatically to match the name you entered. | | Execute on | Option to select whether to use a specific MID Server or a MID Server cluster. This field is required. | | MID server name | (Only when the Execute on field is set to Specific MID Server) MID Server to which log data from Splunk is pulled. This field is required. Note: * You can select only MID Servers that support basic authentication. MID Servers that support mTLS are not listed. * The default maximum number of data inputs streaming logs to a single MID Server is 10. You can modify this number in the MID Server properties. * If log ingestion is not enabled for the selected MID Server, Health Log Analytics enables it automatically. {#il-connector-hla-splunkpoll-fields__ul_hxz_y2b_m2c} | | MID Server Cluster | (Only when Execute on is set to Specific MID Server cluster.) The MID Server cluster to which the log data is pulled. This field is required. The data input runs on a single MID Server in the cluster until that MID Server fails. The system then moves all the data input tasks to the next available MID Server in the cluster according to the configured order. Note: * Health Log Analytics supports only failover MID Server clusters. In these clusters, multiple MID Servers are grouped together for failover protection. When selecting a cluster from the data input or integration form, the MID Server clusters list displays only failover clusters. * Log ingestion must be enabled for each MID Server in the cluster. If log ingestion is not enabled for the active MID Server, Health Log Analytics enables it automatically. * The default maximum number of data inputs or integrations streaming logs to a single MID Server is 10. A cluster passes capacity validation if it contains at least one MID Server with fewer than 10 data inputs or integrations running on it. This is true even when that MID Server is down. {#il-connector-hla-splunkpoll-fields__ul_htt_wdq_dwb} For more information about MID Server clusters, see [Configure a MID Server cluster](https://www.servicenow.com/docs/access?context=t_ConfigureAMIDServerCluster&version=australia&pubname=australia-servicenow-platform&ft:locale=en-US). | | Service instance | The service instance (formerly the application service) to which to bind the log data. This field is required. | | Data source | The source of the log data that the integration pulls to your ServiceNow instance: Splunk. This field is read-only. | | Description | Option to add a brief description of the integration to help identify it. | [Table 1. Provide details] {#il-connector-hla-splunkpoll-fields__table_fhy_yq1_m2c} {#il-connector-hla-splunkpoll-fields__table_ns2_1r1_m2c__entry__2} | Field | Description | |-|-| | REST API Server URL | The URL used to access the Splunk REST API. This field is required. Note: * By default, the Splunk REST API endpoint is available on port 8089. Therefore, the default endpoint for the Splunk REST API is: `http://:8089`. * The REST API endpoint is different from the front-end endpoint. {#il-connector-hla-splunkpoll-fields__ul_as2_j2h_42c} | | Authentication method | The credential alias to be used. This field is required. The Splunk integration uses credential aliases instead of direct references to credentials for authentication. The credential aliases are listed by type: aliases that contain basic auth credentials, and those that contain token auth credentials. If an alias holds both credential types, it appears in both categories. You can select Manage credential aliases to manage your credential aliases and create new ones in the Connection \& Credential Aliases list. | | Query | The query Splunk uses to search your data. This field is required. For example, the query sourcetype="adc_access_log" instructs the Splunk Poller integration to retrieve all logs with the source type adc_access_log. | [Table 2. Set data retrieval method] {#il-connector-hla-splunkpoll-fields__table_ns2_1r1_m2c} {#il-connector-hla-splunkpoll-fields__table_akj_br1_m2c__entry__2} | Field | Description | |-|-| | Max documents per query | The maximum number of documents retrieved each time log data is fetched from Splunk. Default: 10,000. | | Splunk Request Timeout (seconds) | The maximum time, in seconds, allowed for data retrieval before the request times out. | [Table 3. Advanced settings] {#il-connector-hla-splunkpoll-fields__table_akj_br1_m2c}