To enable the sharing of event data from your ServiceNow instance to your Splunk instance, you will need to create a bulk and/or dynamic share. A bulk share is a one-time share of data from one instance to another. A dynamic share allows for real time sharing of ServiceNow records as they are created, updated, and deleted. Creating a bulk share and dynamic share will share out your ServiceNow event data immediately as well as share out subsequent event data that is collected as ServiceNow records are created, updated, and deleted.
Prerequisites
You will first need to install the Perspectium Core update set. You can request a download link for this update set by contacting Perspectium Support.
You will also need to have a shared queue that points to your Splunk instance. This queue should have been created by Perspectium Support upon initial configuration of your ServiceNow instance.
Procedure
To create a bulk/dynamic share for your ServiceNow-to-Splunk integration, follow these steps:
To create a bulk share, navigate to Perspectium > Replicator > Bulk Share or simply type Bulk Share in the Filter Navigator on the upper left-hand side of the screen. Otherwise, continue to Step #3.
Click the New button next to Bulk Shares. In the resulting form's Cipher dropdown, select Base64 Encode Only. Then, follow the remaining steps to create a bulk share for Replicator for ServiceNow.
To create a dynamic share, navigate to Perspectium > Replicator > Dynamic Share or simply type Dynamic Share in the Filter Navigator on the upper left-hand side of the screen.
Click the New button next to Replicator Configurations. In the resulting form's Cipher dropdown, select Base64 Encode Only. Then, follow the remaining steps to create a dynamic share for Replicator for ServiceNow.
Next steps
Similar topics
There is no content with the specified labels
