Additional entity action configuration: Send to ServiceNow

Exposure Analytics has a built-in alert action for pushing asset records to ServiceNow. This action is useful for updating existing ServiceNow assets with accurate, complete asset data or adding unmanaged assets to ServiceNow so you can manage them appropriately.

Note: This alert action pushes data to ServiceNow. To pull ServiceNow asset data into Splunk, use the Splunk Add-on for ServiceNow and configure add-on inputs for cmdb_ci_server and cmdb_ci_computer. Predefined entity discovery sources are available for data pulled in through these inputs.

Configure the Send to ServiceNow alert action: Overview

Create an entity action for each import set that you push data to. For example, if you are pushing workstations and servers, create two entity actions and add the Send to ServiceNow alert action to each one.

To configure the Send to ServiceNow alert action, complete the following general steps. See separate sections under this list for details on each step.

  1. Create an import set table and transform map in ServiceNow.

  2. Enable the ServiceNow alert action.

  3. Add your ServiceNow instances and import sets.

  4. Add an entity action condition and map fields.

  5. Add the alert action to the condition

Step 1: Create an import set table and transform map in ServiceNow

An import set table acts as a staging location for records imported from a data source before those records are transformed. The integration uses a REST API to send data to the import set table.

Create an import set table, then create a transform map in ServiceNow to convert the data in the import set table to another table according to the transform map rules.

Create an import set table:

  1. In ServiceNow, select System Web Services, then Inbound, and then Create New.

  2. Add the fields from the Exposure Analytics asset inventory that you want to include in ServiceNow.

Create a transform map:

  1. In ServiceNow, select System Import Sets, then Create Transform Map.

  2. Enter a name for the transform map.

  3. Set the import set table as the Source table.

  4. Select a Target table, such as cmdb_ci_server.

  5. Select the Create a new record on empty coalesce fields check box if you want to create new asset records in the target table when the asset does not already exist.

  6. Create the mapping from the import set source table to the target table.

Map the source fields to the target table:

  1. Select System Import Sets, then Administration, and then Transform maps.

  2. Select the transform map that you created.

  3. In the Related Links section, select Mapping Assist.

  4. Map the source fields from the import set table to the target table.

  5. Select Save after all fields are mapped.

  6. In the Field Maps table, find the source field to use as the key field for the data set. The key field uniquely identifies the asset in your ServiceNow environment. For example, it might be the hostname or serial number.

  7. For that field, change the Coalesce column value to true.

  8. Select Update to save the key field change.

Configure synchronous transformations to allow for multiple record updates:

  1. Select System Web Services, then REST, and then Insert Multiple.

  2. Select New, then enter a name.

  3. Set the import set table you created as the source table.

  4. Change the transformation to Synchronous.

  5. Select Submit.

  6. Select the row that you created.

  7. In the Column mappings table, select New.

  8. Select these values:

    • Type: JSON

    • Column mapping: Column name

  9. Select Submit.

For more information about import set tables and transform maps, see the ServiceNow documentation on import sets.

Note: By default, ServiceNow import set field values have a 40-character limit. You might need to edit the ServiceNow data dictionary for import set fields, such as u_serial_number, to increase the limit. For example, a VMware serial number can exceed 40 characters. If you do not increase the field limit before importing, ServiceNow records only the first 40 characters.

Step 2: Enable the ServiceNow alert action

The ServiceNow alert action is hidden by default and must be enabled.

To enable the ServiceNow alert action, complete the following steps:

  1. Select Configure, then Exposure Analytics, and then Configuration settings.

  2. Select the Default configurations tab.

  3. Under Entity actions, change the ServiceNow action toggle to On.

You can also turn off the ServiceNow alert action by changing the ServiceNow action toggle to Off.

Step 3: Add ServiceNow instances and import sets

Add one or more ServiceNow instances and associated import sets to the ServiceNow configuration under Entity actions in Exposure Analytics. You can add and save multiple instances and import sets to send data to import set tables in different ServiceNow environments. For example, if you have an import set table in a test environment and another in a production environment, you can add both instances and send data to either one.

Note: To push data from Entity actions in Exposure Analytics, you need ServiceNow credentials. Create a ServiceNow service account with permissions to the import set table and any transform rules or mappings.

To add a ServiceNow instance and import set to the ServiceNow configuration, complete the following steps:

  1. Select Configure, then Exposure Analytics, and then Entity actions management.

  2. Select the ServiceNow configuration tab.

  3. Select Add.

  4. Enter a name for the ServiceNow instance so you can select it when configuring an alert action. For example, enter Test for a test instance.

  5. Enter the Instance URL. The URL must begin with https:// and must not include an additional path. For example, https://myserver.service-now.com.

    Note: Do not include the import set table name at the end of this URL.

  6. Enter the name of the import set table you want to use. For example, a table name might be u_cmdb_ci_server.

    Note: The Full path URL is generated automatically and includes both the instance and the import set table. For example, an instance URL of https://myserver.service-now.com and an import set table named u_servers produce the full path URL https://myserver.service-now.com/api/now/import/u_servers.

  7. Enter the username and password for the ServiceNow service account you created.

  8. (Optional) Select Test connection before saving.

  9. Select Save.

Repeat these steps for any additional ServiceNow instances or import set tables.

Step 4: Add an entity action condition and map fields

Follow the steps in Add an entity action to create an entity action condition. The condition will likely represent a subset of data that you want to send to ServiceNow. For example, you could create an asset record condition with a filter that finds servers seen on the network in the past day that are not in ServiceNow. This example assumes you are pulling data from ServiceNow as an entity discovery source.

In the Additional logic box of the entity action condition, add logic to ensure that the fields sent to ServiceNow match the fields expected by the import set table.

For example, the additional logic might look like this:

SPL 
| rename nt_host AS u_host_name, vendor AS u_manufacturer, product AS u_model_id, asset_type AS u_sys_class_name, serial AS u_serial_number, user_id AS u_assigned_to, os AS u_os, os_version AS u_os_version, dns AS u_dns_domain, asset_class AS u_chassis_type, category AS u_short_description, mem AS u_ram, cpu_mhz AS u_cpu_speed, cpu_count AS u_cpu_count, cpu_cores AS u_cpu_core_count, city AS u_city, state AS u_state, country AS u_country, location_id AS u_location, lastdetect AS u_most_recent_discovery
| eval u_discovery_source="EA"
| fields u_*
| convert ctime(u_most_recent_discovery) timeformat="%Y-%m-%d %H:%M:%S"

In this example, fields in the ServiceNow import set table use the u_XXXX syntax. To find the field names needed for this search, select System Web Services in ServiceNow, then select your import set table and check the Name column.

Note: This example assumes that assets in ServiceNow use hostnames as unique identifiers. If your ServiceNow environment identifies assets by serial number, modify the search so that each result row is uniquely identified by serial number.

After Preview displays the results in the required format, select Save to save the condition.

Step 5: Add the alert action to the condition

Follow the steps in Add an entity action to add the Send to ServiceNow alert action to the entity action condition you created.

After you select the Send to ServiceNow alert action, configure it as follows:

  1. Instance: Select the ServiceNow instance with the import set table you want to send data to.

  2. Key Field: Specify the field to use as the unique key. For example, you might use u_host_name if ServiceNow expects hostname as the unique key.

  3. Batch Size: Specify how many records to send at a time. Splunk Asset and Risk Intelligence sends data to ServiceNow in batches.

    Note: The batch size must be between 2 and 200.

  4. Debug: Enable debug logging output from the alert action. Leave this field unchecked unless you need to troubleshoot an issue.

  5. Filter Blanks: Specify whether to send empty values to ServiceNow. Set this option to Off if you do not want to send empty values.

  6. Dry Run: Run all Send to ServiceNow steps except pushing the asset data to ServiceNow. Use this option to validate authentication.

  7. Select Add action when configuration is complete.

After you configure and add the alert action, assets are sent to ServiceNow the next time the entity action runs. You cannot run the action manually.

To force the search to run, schedule the entity action condition to run in two minutes, save it, and let it run the alert action. After you validate everything, change the schedule to a more suitable time and frequency.

Troubleshoot the ServiceNow alert action

In Exposure Analytics, monitor configured searches that use the ServiceNow alert action on the ServiceNow sync summary dashboard. To open the dashboard, select Analytics, then Exposure Analytics, and then Exposure Analytics diagnostics.

Select the ServiceNow summary tab on the diagnostics dashboard. The tab contains the following data:

Dashboard panel Description
Executions by time The number of times the ServiceNow sync alert action has run in the past 24 hours.
Errors and warnings by time The number of errors and warnings from the ServiceNow alert action in the past 24 hours.
Sync results by time The search run results from the ServiceNow alert action in the past 24 hours.
Alert logs The log events output from the ServiceNow alert action in the past 24 hours. You can filter this event list by log level.