topic Re: Monitoring ServiceNow logons with Splunk Add-on in All Apps and Add-ons

Monitoring ServiceNow logons with Splunk Add-on

capilarity — Wed, 30 Sep 2020 03:24:09 GMT

We are trying to monitor who is logging on to our ServiceNow instance. We have the add-on installed and we are getting data from various tables with ServiceNow but none on them appear to show who has logged on and when.
we are currently ingesting the following tables:

syslog_transations
sysevent
sys_user_list
syslog
sys_audit
sys_user

All 6 tables are being indexed, but none of them show which user have logged in. Ideally, we would like to set up reporting/alerting when admins and third party support users log on

Thanks

Re: Monitoring ServiceNow logons with Splunk Add-on

hkubavat_splunk — Wed, 18 Dec 2019 11:49:57 GMT

You can try ingesting em_event table. It should have logging activities.

Re: Monitoring ServiceNow logons with Splunk Add-on

capilarity — Wed, 18 Dec 2019 12:53:51 GMT

Thanks for the quick response.

I get {"reason":null,"error":"Invalid table: em_event"}

as a response to the call https://ourinstance.service-now.com/em_event.do?JSONv2&sysparm_query=sys_created_on>=2019-12-01+00:00:00^ORDERBYsys_created_on&sysparm_record_count=50 ourinstance.service-now.com

I guess that means they haven't set it up? or is a default table. Not a ServiceNow expert, unfortunatly neither are our support providers!!

Re: Monitoring ServiceNow logons with Splunk Add-on

atolia_splunk — Wed, 18 Dec 2019 13:07:31 GMT

It can be found in sysevent table with 'name=login' included in the search query which will give the login success events for a particular ServiceNow instance.

Re: Monitoring ServiceNow logons with Splunk Add-on

atolia_splunk — Wed, 18 Dec 2019 13:11:11 GMT

It can be found in sysevent table. Please try searching with (sourcetype="snow:sysevent" name=login) in Splunk search. It will give the events of login success for a particular ServiceNow instance which will have username details as well.

Re: Monitoring ServiceNow logons with Splunk Add-on

capilarity — Wed, 18 Dec 2019 13:16:43 GMT

Thanks, That's found it!! I was looking for usernames, but it actually uses email addresses.

Re: Monitoring ServiceNow logons with Splunk Add-on

artelia — Fri, 11 Feb 2022 15:18:05 GMT

Hi capilarity,

Were you able to ingest all those tables without any issues?
We are currently trying to do (almost) the same, but are experiencing the following issue:

"2022-02-10 09:08:31,159 ERROR pid=12171 tid=Thread-20 file=snow_data_loader.py:collect_data:181 | Failure occurred while getting records for the table: syslog_transaction from https://---net/. The reason for failure= {'message': 'Transaction cancelled: maximum execution time exceeded', 'detail': 'maximum execution time exceeded Check logs for error trace or enable glide.rest.debug property to verify REST request processing'}. Contact Splunk administrator for further information."

In case you did also experience this before eventually succeeding with your task, do you remember what you did to prevent the above message to pop up in the Splunk logs instead of pulling in the relevant data?

Thanks!

Re: Monitoring ServiceNow logons with Splunk Add-on

Yuvaraja — Mon, 22 Jan 2024 07:23:17 GMT

Can you please say, what do we need to enable on servicenow instance to send it's log to splunk. I enabled sysevent and syslog_audit on splunk instance. But not receiving logs. What to do?