All Apps and Add-ons

Monitoring ServiceNow logons with Splunk Add-on

capilarity
Path Finder

We are trying to monitor who is logging on to our ServiceNow instance. We have the add-on installed and we are getting data from various tables with ServiceNow but none on them appear to show who has logged on and when.
we are currently ingesting the following tables:

  • syslog_transations
  • sysevent
  • sys_user_list
  • syslog
  • sys_audit
  • sys_user

All 6 tables are being indexed, but none of them show which user have logged in. Ideally, we would like to set up reporting/alerting when admins and third party support users log on

Thanks

0 Karma
1 Solution

atolia_splunk
Splunk Employee
Splunk Employee

It can be found in sysevent table. Please try searching with (sourcetype="snow:sysevent" name=login) in Splunk search. It will give the events of login success for a particular ServiceNow instance which will have username details as well.

View solution in original post

atolia_splunk
Splunk Employee
Splunk Employee

It can be found in sysevent table. Please try searching with (sourcetype="snow:sysevent" name=login) in Splunk search. It will give the events of login success for a particular ServiceNow instance which will have username details as well.

View solution in original post

capilarity
Path Finder

Thanks, That's found it!! I was looking for usernames, but it actually uses email addresses.

0 Karma

atolia_splunk
Splunk Employee
Splunk Employee

It can be found in sysevent table with 'name=login' included in the search query which will give the login success events for a particular ServiceNow instance.

0 Karma

hkubavat_splunk
Splunk Employee
Splunk Employee

You can try ingesting em_event table. It should have logging activities.

0 Karma

capilarity
Path Finder

Thanks for the quick response.

I get {"reason":null,"error":"Invalid table: em_event"}

as a response to the call https://ourinstance.service-now.com/em_event.do?JSONv2&sysparm_query=sys_created_on>=2019-12-01+00:0... ourinstance.service-now.com

I guess that means they haven't set it up? or is a default table. Not a ServiceNow expert, unfortunatly neither are our support providers!!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!