After setting up your bulk or dynamic share within your SeviceNow sharing instance, ServiceNow data will be collected into Splunk's HTTP Event Collector. Event Collections can be filtered by source type if multiple data sources were configured when generating your Splunk Event Collector token.
Prerequisites
You will first need to create a ServiceNow bulk/dynamic share for Splunk.
You will also need to point your Splunk HTTP Event Collector port to the Perspectium Integration Mesh and generate a Splunk Event Collector token.
Procedure
To view your event collections in Splunk, follow these steps:
After executing your bulk share for Splunk or creating your dynamic share for Splunk and creating/updating/deleting records, log into your Splunk instance and click the Splunk logo to navigate to your instance's homepage.
From the left side navigation menu, click Search and Reporting.
On the resulting page, click the Data Summary button under What to Search. Then, click your Spunk instance name under Host.
Your event collection data will appear on the resulting page.
If no data appears or if you want to view data for a specific time/date range, click the Last 24 hours dropdown at the top right-hand corner of the form to change the time range for which your event collection data will be displayed.
