Cribl integration configuration fields

  • Release version: Zurich
  • Updated July 31, 2025
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Cribl Integration Configuration Fields

    The Cribl integration configuration fields are essential for setting up the Health Log Analytics in ServiceNow, allowing for efficient streaming of log data from Cribl instances to your ServiceNow platform. This integration enables IT Operations Management to effectively manage and analyze log data.

    Show full answer Show less

    Key Features

    • Integration Name: A unique identifier for the integration, required to customize the integration's display name.
    • Service Instance: Specifies the service instance to bind the log data, essential for proper data routing.
    • MID Server Name: The designated MID Server for streaming Cribl logs, necessary for connection.
    • Port: A specific port (6000-6200) on the MID Server for log streaming, must be open as per security protocols.
    • Cribl URL: Required URL for the Cribl instance, crucial for establishing an API connection.
    • Authentication Method: Supports token-based and basic authentication for secure data access.
    • Worker Group: Specifies the Cribl Worker Group for log data streaming, available in a dropdown list.
    • Cribl Route: Directs log data to specific destinations, auto-populated for ease of use.
    • Cribl Destination: Auto-populated and read-only field indicating where log data is sent, with links to the destination.

    Key Outcomes

    By configuring these fields correctly, ServiceNow customers can ensure a seamless integration with Cribl, which enhances log management capabilities, improves data visibility, and supports better operational insights through effective log analytics.

    Description of the fields on the Cribl integration configuration forms for Health Log Analytics.

    Table 1. Provide details
    Field Description
    Integration Name Unique name of this integration. For example: My Cribl integration. This field is required.
    Note:
    When you fill in this field, the generic name displayed on the form adjusts automatically to match the name you entered.
    Service Instance The service instance (formerly the application service) to which to bind the log data. This field is required.
    MID Server name The MID Server to which the Cribl logs are streamed. This field is required.
    Port The port on the MID Server. This field is required.

    Choose a port within the range 6000-6200 from the array. The port must not be occupied by another process. Make sure that your organization’s security team opens the selected port on the MID Server.
    Description Option to add a brief description of the integration to help identify it.
    Transport (for push integrations) The protocol used for streaming log messages to your ServiceNow instance: TCP. This field is read-only.
    Source (for pull integrations) The source of the log data that the integration pulls to your ServiceNow instance: Cribl. This field is read-only.
    Table 2. Set up connection
    Field Description
    Cribl URL The URL of the Cribl instance. This field is required.

    HLA uses this URL to establish the connection with the Cribl instance and make the necessary API calls.

    For example:
    • On-Prem: https://my-cribl.company.com:9000
    • Cloud: https://myorg-12345abcde.cribl.cloud
    • Sandbox: https://sandbox-xyz789.sandbox.cribl.io
    Authentication method The authentication method used by the Cribl integration. This field is required.
    The Cribl integration supports:
    • Token-based authentication: Required for Cribl Cloud and also supported for self-hosted (On-Prem) Cribl instances.
    • Basic authentication: Preferred for self-hosted (On-Prem) Cribl instances.
    Both of these authentication methods use the default credential alias: Cribl_Credential_Alias.
    For information about setting up credentials for the authentication method used by the Cribl integration, see Set up authentication credentials for the Cribl integration in Health Log Analytics.
    Important:
    Verify that only one active credential record of each credentials type exists under the credential alias.
    Worker Group The Cribl Worker Group from which to stream log data to the instance. This field is required.

    The drop-down list displays Worker Groups based on the provided Cribl cloud instance URL and authentication method.

    For example:
    • default
    • dev-workers
    • prod-workers
    • staging-workers
    Cribl route The Cribl route that directs log data to a specific destination.

    This field is auto-populated with a drop-down list of all available routes, each configured with a default destination. Select the desired route from the list. This field is required.

    For example:
    • default
    • demo-route
    Cribl destination The Cribl destination to which the log data is directed. This field is auto-populated and read-only.

    When HLA populates this field, it provides a link to the destination on the Cribl server.

    For example: sn_hla_cribl_tcp_json_abcdef