How do you get ServiceNow CI data indexed in Splunk?

[kelsiej]

The plugin pushes Splunk data into ServiceNow, but what I'm looking to do is push CI data from ServiceNow into Splunk. ServiceNow has asset data that we want to push to Splunk to combine with the SecurityCenter data we have in Splunk in order to catagorize vulnerabilities by Risk. Has anyone successfully done this, or tried this before?

[rajeev_ku]

Hi,
You can use ServiceNow apps as well.

https://splunkbase.splunk.com/app/1770/

[Jeremiah · Accepted solution]

The app supports polling the Service Now API. So absolutely you can index CMDB tables from Service Now into Splunk, along with task, incident, and any other table data you have.