I'm looking to send events from Splunk to ServiceNow using the add-on.
The catch is, for security reasons, we may be required to push the data from Splunk to ServiceNow via a MID Server.
Normal approach:
Splunk -> ServiceNow
Possible approach required for the client:
Splunk -> MID Server -> ServiceNow
Does the add-on support sending the event to the MID server at all? If not, what are the alternative options available?
if that MID server supports Snow API and there should be some scripted alert action to send data, it should work i guess.
Basically in the Event integration configuration, you need to provide node details.
If you want to send the events as an incident you should provide API details as below.
/api/now/table/incident
Hi,
Is your Splunk environment a SaaS environment?
I was told that for Splunk On-prem, you need to use the MId server.
Thanks