Splunk Enterprise

Does anyone have advice about consuming large amounts of data from ServiceNow?

Chris_SNOW
Observer

Hi Splunk Community,

I was wondering if anyone might be able to provide some advice around using the ServiceNow add-on for Splunk specifically in regards to the consuming data from the CMDB.

There are OOB Inputs that come with the add-on which are fine for some basic tables however I'm looking at the CI relationship table which currently contains 19m+ records! We don't want to consume all of those as we're only really interested in the ones that relate to the basic tables we're already importing using the OOB inputs, which is around 10 tables.

The filters available with the add-on don't provide enough functionality to filter our requirement. Maybe a custom REST API call not within the ServiceNow add-on or maybe a post from ServiceNow to Splunk is the way to go.  Keen to hear how others might have tackled anything similar?

Labels (1)
Tags (2)
0 Karma

Rajiv_splunk
Path Finder

HI @Chris_SNOW 

Even i am facing the same issue, did you able to fix your issue if yes then please guide me as well

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...