Cribl integration configuration fields
Summarize
Summary of Cribl integration configuration fields
This guide details the configuration fields required to set up the Cribl integration for Health Log Analytics (HLA) in ServiceNow. This integration enables streaming and pulling of log data between Cribl and your ServiceNow instance, facilitating centralized log management and analytics.
Show less
Integration Identification and Binding
- Integration Name: A unique, required identifier for the integration. Naming this field customizes the generic form label accordingly.
- Service Instance: The specific ServiceNow service instance to bind the incoming log data. This is mandatory to link logs correctly.
- MID Server Name: The required MID Server that will receive the streamed Cribl logs.
- Port: A mandatory field specifying the port number on the MID Server (between 6000-6200) used for log streaming. Ensure this port is free and opened by your security team.
- Description: Optional short description to help identify the integration.
- Transport (push integrations): Read-only field indicating the protocol used (TCP) for log streaming to ServiceNow.
- Source (pull integrations): Read-only field showing the origin of the log data (Cribl).
Connection Setup
- Cribl URL: Required URL of the Cribl instance (On-Prem, Cloud, or Sandbox) for API communication and data streaming.
- Authentication Method: Mandatory selection between token-based (required for Cribl Cloud, supported for On-Prem) or basic authentication (preferred for On-Prem). Both use the credential alias CriblCredentialAlias. Ensure only one active credential record per type exists under this alias.
- Worker Group: Required selection of a Cribl Worker Group from which logs will be streamed. The list is populated based on the Cribl URL and authentication.
- Cribl Route: Required selection of the route directing log data to its destination. This list is auto-populated with available routes configured on the Cribl server.
- Cribl Destination: Read-only field showing the destination of log data, populated based on the selected route. Provides a direct link to the destination on the Cribl server.
Practical Considerations for ServiceNow Customers
By accurately configuring these fields, you enable seamless integration between Cribl and ServiceNow Health Log Analytics, ensuring efficient log data ingestion and routing. Proper setup of the MID Server, port, and authentication is critical for secure and reliable connectivity. Selecting the appropriate Worker Group and route ensures logs are streamed from the correct source to the intended destination, enabling effective log analysis within ServiceNow.
Description of the fields on the Cribl integration configuration forms for Health Log Analytics.
For the Cribl integration setup procedure, see Set up a Cribl integration for Health Log Analytics.
| Field | Description |
|---|---|
| Integration Name | Unique name of this integration. For example: My Cribl integration. This field is required. Note: When you fill in this field, the generic name displayed on the form adjusts automatically to match the name you entered. |
| Service Instance | The service instance (formerly the application service) to which to bind the log data. This field is required. |
| MID Server name | The MID Server to which the Cribl logs are streamed. This field is required. |
| Port | The port on the MID Server. This field is required. Choose a port within the range 6000-6200 from the array. The port must not be occupied by another process. Make sure that your organization’s security team opens the selected port on the MID Server. |
| Description | Option to add a brief description of the integration to help identify it. |
| Transport (for push integrations) | The protocol used for streaming log messages to your ServiceNow instance: TCP. This field is read-only. |
| Source (for pull integrations) | The source of the log data that the integration pulls to your ServiceNow instance: Cribl. This field is read-only. |
| Field | Description |
|---|---|
| Cribl URL | The URL of the Cribl instance. This field is required. HLA uses this URL to establish the connection with the Cribl instance and make the necessary API calls. For example:
|
| Authentication method | The authentication method used by the Cribl integration. This field is required. The Cribl integration supports:
For information about setting up credentials for the authentication method used by the Cribl integration, see Set up Cribl integration authentication credentials. Important: Verify that only one active credential record of each credentials type exists under the credential alias. |
| Worker Group | The Cribl Worker Group from which to stream log data to the instance. This field is required. The drop-down list displays Worker Groups based on the provided Cribl cloud instance URL and authentication method. For example:
|
| Cribl route | The Cribl route that directs log data to a specific destination. This field is auto-populated with a drop-down list of all available routes, each configured with a default destination. Select the desired route from the list. This field is required. For example:
|
| Cribl destination | The Cribl destination to which the log data is directed. This field is auto-populated and read-only. When HLA populates this field, it provides a link to the destination on the Cribl server. For example: sn_hla_cribl_tcp_json_abcdef |