How to configure Splunk Add-on for ServiceNow to not pull data from sys_audit, sys_log, and syslog_transactions?

[thefuzz4]

So we just enabled our ServiceNow connector on a heavy forwarder of ours to ingest all of our data in our ServiceNow Cloud via the API. The problem we're running into is that our ServiceNow database is so huge that it's hanging up on the sys_audit table and it's hindering other company activities because ServiceNow is telling those users that there are too many connections.

So I tried to disable that input in Splunk and told Splunk don't ingest anything from sys_audit, sys_log, syslog_transactions because, well, I really don't need that data for what we're attempting to accomplish. Once I disabled those, I bounced the heavy forwarder, but we're still seeing in the logs both on the forwarder and the SN logs that we're still attempting to pull that data from it.

Anyone got any suggestions on how to not pull in this data? Thank you all for your help in advance.

[Jeremiah · Accepted solution]

On your heavy forwarder, in your $SPLUNK_HOME/etc/apps/Splunk_TA_snow/local/inputs.conf file make sure to have the following:

[snow://sys_audit]
disabled = 1 

[snow://syslog]
disabled = 1

[snow://syslog_transaction]
disabled = 1

Then restart your heavy forwarder. If the tables are still being accessed, make sure that you have not accidentally enabled the inputs on another instance of Splunk (like a search head or indexer).

[thefuzz4]

Turns out it wasn't splunk that was bombing it. We created a new account just for the splunk ingest and lowered the intake down to once every 15 mins. I also did verify that they're all set to disabled as well. Thank you for your answer and we can close this out.