Asking for the status of a certain CI or one of the IPC records you always get the latest one that matches ServiceNow.Being able to list all the (open, new, etc.) Incidents, Changes, and/or Problems belonging to a ServiceNow support group certain users belong to.Within Splunk can use all of the ServiceNow CSDM objects to power Splunk knowledge objects.Within Splunk can use the CMDB information (content AND CONTEXT) for searching data and power the Splunk knowledge objects.And not searching for it in an index but just right at your fingertips with the latest details. Within Splunk have an overview of all of the (open, new, etc.) Incidents, Changes, and/or Problems.
In my opinion the functional integration should do the following: And yes I’ve worked with the mentioned add-on at all of my customers but always with limited success. Working with Splunk Enterprise for over 7 years mainly in the IT Operations space but also the security space they all wanted to have a functional integration instead of only technical. More details about some of the above points can be found at Splunk – ServiceNow.
#Using splunk enterprise security how to#
With the upcoming IT4IT reference architecture, how to increase the adoption of the service or product model backbone in the organization?.How can Splunk and ServiceNow tooling be used in conjunction together to help the application/DevOps teams to deliver better outcomes?.That’s because the application/DevOps teams would like to have dashboards showing the health of their application or service. Splunk knowledge objects (dashboards, reports, etc) were sometimes hardcoded with underlying infrastructure details.This is a huge problem in the area of who is maintaining them, what about the adoption and quality of the central ServiceNow CMDB/CSDM, how to really correlate Splunk data from server (host) multiple relationships up to the business service, etc. There are a lot of shadow CMDBs within Splunk: Tags, lookups, etc.Looking at all of those Splunk installations I’ve worked with the last seven years I found: Or let me rephrase it more accurately, it is really difficult if not impossible for users of Splunk to do so.
But what about relationships between all of those objects it collects? How do I know the status of a certain CI? How can I find out the servers (hosts) belonging to a certain application of business service? Oh yes, it comes with some means of transforming those time-based collections into lookups (kvstore) but still, I cannot answer the mentioned questions. All the things this add-on is collecting are stored in Splunk event indices. The add-on is doing a great job from a Splunk alert perspective but all of the others are more technical than functional. And it also provides Splunk alert actions to create ServiceNow events or incidents. That add-on collects incident, event, change, user, user group, location, and CMDB CI information from ServiceNow.
Well of course there is the “Splunk Add-on for ServiceNow” on Splunk base.
What is there on the Splunk market already? It is one of the use cases of my Common/Corporate Metadata Data Management (CMDM) solution by doing the Splunk and ServiceNow integration. This post is focused on letting ServiceNow CMDB (CSDM) and IPC working together with Splunk Enterprise, Splunk Enterprise Security, and Splunk IT Service Intelligence. This is part 3 of the “Splunk and CMDB/CSM/IT4IT blog series”.
0 kommentar(er)
