Nothing is required to be installed on ServiceNow side, but just an API account enabled in ServiceNow . (eg . splunk_access_account) then test this account from your remote server using CURL . (replace the values accordingly) curl -k username:password http://{xyzcompany}.service-now.com/table/{tableName}/{sys_id} Check the response and ensure your API account works and response is fetched. Then configure inputs.conf in your ServiceNow addon (or separate app of your own) in your HeavyForwarder or Collection Splunk system and pull a table (eg incident table) ... View more