Splunk® App for ServiceNow

Installation and Configuration Manual

Download manual as PDF

Download topic as PDF

Share data in the Splunk App for ServiceNow

The Splunk App for ServiceNow includes the ability to opt-in to send anonymized usage data to Splunk. Splunk uses this data to help improve the app in future releases.

How the app collects data

If you opt in, the app enables an internal library to track basic usage and crash information. The library uses browser cookies to track app user visitor uniqueness and sessions and sends events to Splunk using XHR in JSON format.

Data the app collects

When enabled, the app sends specific metrics back to Splunk.

  • Basic app page information, including page name, memory usage, and loading performance.
  • The version number of both Splunk Enterprise and the app.
  • The daily indexed data volume for the app sourcetypes.

Common fields the API uses

The data that the Splunk App for ServiceNow sends to Splunk includes the following common fields. This includes several fields that are disabled or deliberately unpopulated for the purposes of anonymization.

Field Type Description Example value
apiKey string MINT API key for the app 5tr1ng
appRunningState Field is unused by the SDK. Shows a value of "NA" in all events.
appVersionCode Field is unused by the SDK. Shows a value of "NA" in all events.
appVersionName string The version name of the app sending data. 1.1.0
browser string The browser name. Chrome
browserVersion string The browser version. 47.0.2526.111
carrier Field is unused by the SDK. Shows a value of "NA" in all events.
connection Field is unused by the SDK. Shows a value of "NA" in all events.
device string The device making the request. MacIntel
extraData JSON object This field stores custom information for the app. This app uses extraData.splunk_version to store the version number of the Splunk platform instance. 6.3.1511
locale string The user locale set in the browser. en-US
osVersion string The version code of the underlying operating system. OS X 10.11.2
packageName string The package name of the app. splunk_app_servicenow
platform Field is unused. Shows a value of "web" in all events.
remoteIP Field is unused.
sdkVersion string The version of the SDK. 4.3
screenOrientation Field is unused by the SDK. Shows a value of "NA" in all events.
session_id string A unique string to identify a session. a5026251
state string Indicator of whether the browser is online or not. Can be either CONNECTED or DISCONNECTED. CONNECTED
uuid UUID A random identifier to track the user's uniqueness 837227ea-4569-4675-9a17-ccb39ca69505
disabledCount integer A value that represents the number of inputs that are disabled in the Configure -> Data inputs page. 20
enabledCount integer A value that represents the number of inputs that are enabled in the Configure -> Data inputs page. 1

Additional API fields

Event Source Type Description Data sent includes the common fields, plus
Field Type Description
Session start mint:ping Each ping event indicates that a new session has started. fsEncrypted N/A Not used, always "NA"
rooted N/A Not used, always false
Session end mint:gnip Each gnip event indicates that a session has ended. ses_duration int How long the session lasted
Page views mint:view Triggered once per page view in the app. current string The URL of the current web page, without the hostname.
currentView string Not used. Hardcoded to 'examples'.
domProcessingTime int Time spent to process the domain.
domLookupTime int Time spent to look up the domain name.
elapsedTime int Time spent to render the page.
host string The hostname in the URL.
loadTime int Time spent to load the page.
previous string The referrer URL.
serverTime int Time spent to get a response from the server.
API calls mint:network XMLHTTPRequest calls, usually HTTP API calls from client side (browser) to the Splunk server. failed boolean Indicates if the request failed or not.
latency int Time spent before response received.
protocol string Network protocol: either http or https.
requestLength string N/A. Not used.
responseLength int The size of the response.
statusCode string HTTP response code.
url string The request URL, without the hostname.
App performance

and configuration

mint:log Basic usage and performance stats from the app, such as dashboard memory use, and dashboard load time. level int Log level. For example, 60 means 'error'.
log_name any Log content.

Example app performance and configuration events

The app sends samples of the performance and configuration information to Splunk using the log_name field in the mint:log source type. This log_name field contains two sub-fields, name, which indicate which type of logs the app transmits, and data, the content of the tracking log.

The Splunk App for ServiceNow options for name:

  • track_performance. When a user accesses a dashboard in the app, the app sends a record of the performance stats for dashboard memory usage and loading times.
  • track_usage. When a user access a dashboard in the app, the app sends a record of the data volume by sourcetype.
  • input_status. When a user has configured inputs through the app, the app sends a record of how many of the input types are enabled.

Sample performance, usage, and configuration events:

log_name.name Example JSON object
track_performance
{
"carrier":"NA",
"sdkVersion":"4.3",
"device":"MacIntel",
"locale":"en-US",
"log_name":{
"name":"track_performance",
"data":{
"memory":{
"totalJSHeapSize":116000000,
"usedJSHeapSize":76600000,
"jsHeapSizeLimit":1530000000
},
"timing":{
"navigationStart":1470882752319,
"unloadEventStart":1470882752507,
"unloadEventEnd":1470882752507,
"redirectStart":1470882752319,
"redirectEnd":1470882752428,
"fetchStart":1470882752428,
"domainLookupStart":1470882752428,
"domainLookupEnd":1470882752428,
"connectStart":1470882752428,
"connectEnd":1470882752428,
"secureConnectionStart":0,
"requestStart":1470882752428,
"responseStart":1470882752506,
"responseEnd":1470882752507,
"domLoading":1470882752512,
"domInteractive":1470882752624,
"domContentLoadedEventStart":1470882752624,
"domContentLoadedEventEnd":1470882752624,
"domComplete":1470882752624,
"loadEventStart":1470882752624,
"loadEventEnd":1470882752624
}
}
},
"platform":"Web",
"state":"CONNECTED",
"osVersion":"OSX10.11.5",
"level":40,
"remoteIP":"3.0.0.0",
"userIdentifier":"NA",
"connection":"NA",
"appVersionName":"4.0.1",
"appVersionCode":"NA",
"uuid":"f321b3c6-629f-45f7-b9f6-2d53c04ee016",
"apiKey":"331614b3",
"packageName":"splunk_app_servicenow",
"browser":"Chrome",
"browserVersion":"51.0.2704.106",
"extraData":{
"app_id":"cdd0508d-3da5-4749-9238-0adabac14316",
"view_id":"3e0f2473e9-1567771b189",
"hostname":"localhost",
"splunk_version":"6.3.6"
},
"screenOrientation":"NA",
"session_id":"86d64662"
}
track_usage
{
  "carrier":"NA",
"sdkVersion":"4.3",
"device":"MacIntel",
"locale":"en-US",
"log_name":{
"name":"track_usage",
"data":{
"usage":[
{
"volumes":{
"snow:change_request":"0",
"snow:change_task":"0",
"snow:cmdb_ci_list":"0",
"snow:cmdb_ci_server":"0",
"snow:cmdb_ci_service":"0",
"snow:cmn_location_list":"0",
"snow:incident":"0",
"snow:sys_choice_list":"0",
"snow:sys_user_list":"0"
},
"time":"2016-08-04"
},
{
"volumes":{
"snow:change_request":"1.533560751",
"snow:change_task":"1.012773512",
"snow:cmdb_ci_list":"15.257651326",
"snow:cmdb_ci_server":"7.816349024",
"snow:cmdb_ci_service":"4.438152318",
"snow:cmn_location_list":"7.076956750",
"snow:incident":"2.051206587",
"snow:sys_choice_list":"1.651004794",
"snow:sys_user_list":"11.036118511"
},
"time":"2016-08-05"
},
{
"volumes":{
"snow:change_request":"0",
"snow:change_task":"8.587527270",
"snow:cmdb_ci_list":"70.431451799",
"snow:cmdb_ci_server":"36.081693645",
"snow:cmdb_ci_service":"20.483797078",
"snow:cmn_location_list":"32.669598576",
"snow:incident":"10.697422016",
"snow:sys_choice_list":"10.171077720",
"snow:sys_user_list":"50.941390042"
},
"time":"2016-08-06"
},
{
"volumes":{
"snow:change_request":"0",
"snow:change_task":"6.235801693",
"snow:cmdb_ci_list":"49.933969497",
"snow:cmdb_ci_server":"25.580301291",
"snow:cmdb_ci_service":"14.523941985",
"snow:cmn_location_list":"23.162253372",
"snow:incident":"7.660617830",
"snow:sys_choice_list":"7.286391262",
"snow:sys_user_list":"36.117432597"
},
"time":"2016-08-07"
},
{
"volumes":{
"snow:change_request":"9.537773135",
"snow:change_task":"9.238606454",
"snow:cmdb_ci_list":"90.621508603",
"snow:cmdb_ci_server":"46.424256325",
"snow:cmdb_ci_service":"26.359880450",
"snow:cmn_location_list":"42.033105854",
"snow:incident":"12.163468354",
"snow:sys_choice_list":"9.9290199326",
"snow:sys_user_list":"65.543895728"
},
"time":"2016-08-08"
},
{
"volumes":{
"snow:change_request":"16.968839654",
"snow:change_task":"1.678962706",
"snow:cmdb_ci_list":"103.566464416",
"snow:cmdb_ci_server":"53.056520456",
"snow:cmdb_ci_service":"30.125096330",
"snow:cmn_location_list":"48.039049144",
"snow:incident":"13.830142969",
"snow:sys_choice_list":"13.800230979",
"snow:sys_user_list":"74.908011439"
},
"time":"2016-08-09"
},
{
"volumes":{
"snow:change_request":"17.729250898",
"snow:change_task":"8.920829775",
"snow:cmdb_ci_list":"122.212939255",
"snow:cmdb_ci_server":"62.609847076",
"snow:cmdb_ci_service":"35.549274441",
"snow:cmn_location_list":"56.689599042",
"snow:incident":"14.856315631",
"snow:sys_choice_list":"12.825769425",
"snow:sys_user_list":"88.393542282"
},
"time":"2016-08-10"
}
]
}
},
"platform":"Web",
"state":"CONNECTED",
"osVersion":"OSX10.11.5",
"level":40,
"remoteIP":"1.2.3.4",
"userIdentifier":"NA",
"connection":"NA",
"appVersionName":"4.0.1",
"appVersionCode":"NA",
"uuid":"f321b3c6-629f-45f7-b9f6-2d53c04ee016",
"apiKey":"331614b3",
"packageName":"splunk_app_servicenow",
"browser":"Chrome",
"browserVersion":"51.0.2704.106",
"extraData":{
"app_id":"cdd0508d-3da5-4749-9238-0adabac14316",
"view_id":"3e0f2473e9-1567771b189",
"hostname":"localhost",
"splunk_version":"6.3.6"
},
"screenOrientation":"NA",
"session_id":"86d64662"
}
input_status
{
  "carrier":"NA",
  "sdkVersion":"4.3",
  "device":"MacIntel",
  "locale":"en-US",
  "log_name":{
    "name":"input_status",
    "data":{
      "disabledCount":17,
      "enabledCount":4
  }
  },
  "platform":"Web",
  "state":"CONNECTED",
  "osVersion":"OS X 10.11.5",
  "level":40,
  "remoteIP":"1.2.3.4",
  "userIdentifier":"NA",
  "connection":"NA",
  "appVersionName":"${version.major}.${version.minor}.${version.revision}",
  "appVersionCode":"NA",
  "uuid":"f321b3c6-629f-45f7-b9f6-2d53c04ee016",
  "apiKey":"331614b3",
  "packageName":"splunk_app_servicenow",
  "browser":"Chrome",
  "browserVersion":"51.0.2704.106",
  "extraData":{
    "app_id":"cdd0508d-3da5-4749-9238-0adabac14316",
    "view_id":"441f6c2888-15678d297ba",
    "hostname":"localhost",
    "splunk_version":"6.3.6"
  },
  "screenOrientation":"NA",
  "session_id":"b9094524"
}

Data the app does not collect

The Splunk App for ServiceNow does not collect the following kinds of data:

  • Sensitive data such as usernames or passwords.
  • Identifying information such as addresses, phone numbers, IP addresses, hostnames.
  • Indexed data that you ingest into your Splunk platform instance.

The app does not collect data that is not explicitly described in the Data the app collects section above.

Opt in or out

The Splunk App for ServiceNow presents an opt-in request the first time that you access the Configure page after you install the app. You can also opt in at any later time on the Configure page by checking the box at the bottom of the screen. Only Splunk administrators can view the Configure page.

To opt out, leave the box unchecked when the app presents the "Help us improve Splunk products and services" dialog box. If you previously opted in but want to change your response, uncheck the box at the bottom of the Configure page, then click Stop sending data. If you opt out after having previously opted in, the app immediately stops sending data to Splunk.

For more information about how Splunk collects and uses data, please refer to the Splunk Privacy Policy.

PREVIOUS
Troubleshoot the Splunk App for ServiceNow
 

This documentation applies to the following versions of Splunk® App for ServiceNow: 4.0.2, 4.0.3


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters