---
sourceDocument: Brazil IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Splunk UDP

# Splunk UDP integration configuration fields {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Description of the fields on the Splunk UDP integration configuration forms for Health Log Analytics.
For the Splunk UDP integration setup procedure, see [Set up a Splunk UDP integration for Health Log Analytics](https://www.servicenow.com/docs/19EVMtoDgfkvnddHE9BOCQ "Set up an integration to stream log messages to your ServiceNow instance over the UDP transport protocol using a Splunk heavy forwarder. Health Log Analytics processes the ingested log data.").
{#il-connector-hla-splunkudp-fields__table_w5q_lhh_q2c__entry__2}

| Field | Description |
|-|-|
| Integration Name | Unique name of this integration. For example: My Splunk UDP integration. This field is required. Note: When you fill in this field, the generic name displayed on the form adjusts automatically to match the name you entered. |
| MID server name | MID Server to which log data from Splunk is pulled. This field is required. Note: * You can select only MID Servers that support basic authentication. MID Servers that support mTLS are not listed. * The default maximum number of data inputs streaming logs to a single MID Server is 10. You can modify this number in the MID Server properties. * If log ingestion is not enabled for the selected MID Server, Health Log Analytics enables it automatically. {#il-connector-hla-splunkudp-fields__ul_vtd_cjh_q2c} |
| Port | The port on the MID Server used for listening to logs. This field is required. Important: Enter a unique port that no other application on the MID Server uses. Ask your security team to confirm that traffic on that port is allowed. |
| Description | Option to add a brief description of the integration to help identify it. |
| Transport | The protocol used for streaming log messages to your ServiceNow instance: UDP. This field is read-only. |
[Table 1. Provide details]

{#il-connector-hla-splunkudp-fields__table_w5q_lhh_q2c} {#il-connector-hla-splunkudp-fields__table_izz_mhh_q2c__entry__2}

| Field | Description |
|-|-|
| Lookup hostnames | Option to perform DNS lookup to resolve IPs to hostnames. The default value is false. |
| Sub sample receive ratio | The ratio of logs to receive. The default value is -1: no logs are received. For example: If you want one out of every five logs to be received, change the value to 5. |
| Character encoding | The character encoding for this data input. The default value is UTF-8. This field is read-only. |
| Drop if queue is full | Option to discard logs if there is a load on the MID Server. |
| Sub sample drop ratio | The ratio of logs to drop. The default value is -1: no logs are dropped. For example: If you want one out of every five logs to be dropped, change the value to 5. |
| Max length in bytes | The maximum length of log messages in bytes. The default value is 32766. |
| Default timezone | The time zone of events that the system will use if a log does not specify the time zone. By default, the system uses GMT in such cases, but you can specify a different time zone. |
[Table 2. Advanced settings]

{#il-connector-hla-splunkudp-fields__table_izz_mhh_q2c}