ServiceNow addon capture login info including src ip?

[ebaileytu]

I have been asked to capture user login information from our SN instance and I am not sure how to get that data into Splunk. I have the SN add-on installed and I see lots of audit information once someone logs in, but I do not see login info such as username, success or failure and src ip. Can that info be pulled into Splunk? Any idea how?

Thanks!

[ebaileytu · Accepted solution]

for anyone interested you can get this information by turning on access to syslog_transaction table in the SN add-on inputs section under inputs. Ne warned it is a lot of data and you can only pull 1000 events per collection interval so plan accordingly.