Set up a Splunk OpenTelemetry Collector (MID-less) integration for Health Log Analytics

  • Release version: Australia
  • Updated May 4, 2026
  • 3 minutes to read

    • Set up a Splunk OpenTelemetry Collector integration to stream Splunk log data directly to your ServiceNow instance using the OpenTelemetry (OTLP) protocol, without a MID Server.

    Before you begin

    Set up MID-less log streaming via ITOM Gateway. Choose the deployment method based on your expected log volume. For more information, see MID-less log streaming via ITOM Gateway in Health Log Analytics.

    Role required: evt_mgmt_admin

    About this task

    Set up an integration from the Integrations Launchpad in Service Operations Workspace, which you access from the ITOM AIOps configuration center. The AIOps configuration center is a centralized workspace for configuring and managing AIOps features from a single place. The integrations setup process reduces implementation time compared to manual data input setup in the classic interface in Health Log Analytics. For more information, see Integrations Launchpad in Service Operations Workspace for ITOM.

    Procedure

    1. Navigate to Workspaces > Service Operations Workspace.
    2. From the navigation pane, select the AIOps configuration center icon ITOM AIOps configuration center icon.
      The ITOM AIOps configuration center page appears. The configuration center is a centralized workspace. Use it to configure and manage AIOps features from a single place.
    3. From the Integrate section, under Integrations, select Add integration.
      The Integrations Launchpad appears.
    4. In the Browse integrations tab, search for the Splunk OpenTelemetry (MID-less) integration and select its tile.
      Note:
      If you start an integration setup before meeting all prerequisites, a message appears. You can cancel the setup and complete the prior requirements first. Alternatively, you can continue in draft mode and complete the requirements later. Note that you can't activate the integration until you have completed all the prerequisites.
    5. On the Provide details form, fill in the fields and then select Next.
    6. On the Set-up instruction screen, follow the provided procedure to enable sending Splunk log data to ServiceNow using OpenTelemetry.
      1. Copy the provided access token, endpoint, and integration ID to the clipboard.
        These credentials enable Cribl to securely send logs to the ServiceNow ITOM Gateway.
        Table 1. Credentials
        Credential Description
        Access Token The JWT credential passed with every request.
        Endpoint The address to which the data is sent: the ITOM Gateway.
        Integration ID The ID with which the integration identifies to ServiceNow.
      2. In your OpenTelemetry Collector configuration file, exporters section, add an OTLP exporter to forward telemetry data to ServiceNow.
        Typically, the configuration file is otel-collector-config.yaml. 
        exporters:
  otlp/servicenow:
    endpoint: itomgw-prod-gateway-phxbwi.sncapps.service-now.com:443
    headers:
      # Reads the access token from the SERVICENOW_ACCESS_TOKEN env variable
      servicenow-access-token: ${SERVICENOW_ACCESS_TOKEN}
      servicenow-integration-id: 7b36df1387f00f10d696c845dabb351f

        This step tells the collector where to send the data and how to authenticate with your instance.

        For more detailed instructions, see the Configure an OpenTelemetry Collector or 3rd Party agent to send data to HLA [KB2117238] article in the Now Support knowledge base. For further assistance, contact your OpenTelemetry Collector administrator.

    7. Do one of the following.
      • If you completed all the prerequisites before starting the configuration, activate the integration either with or without AI-powered capabilities. Select the appropriate option.
        • Activate with AI enables AI-powered automatic parsing and mapping of log data to service instances and components for contextual alerts.

          When the integration is activated successfully, the Overview tab is displayed. ServiceNow Otto for ITOM collects and analyzes log data. An AI icon indicates that AI is active.

        • Activate activates the integration without AI-powered mapping. The integration is activated and the Overview tab is displayed.

        On the Integrations Launchpad, the integration tile is available in the Installed integrations tab.

      • If you didn't complete all the prior requirements, select Save draft.

        The system saves the integration as a draft in the Integrations Launchpad Installed integrations tab, under Waiting for your action. At a later time, complete the prerequisites and activate the installation. For more information, see Activate a draft integration in Health Log Analytics.

    What to do next

    On the Overview tab, do the following: