End of Support and End of Life Announcement: Splunk App for ServiceNow

Splunk App for ServiceNow offers dashboards and reporting capabilities for customers. As of October 31, 2020, Splunk will no longer be supporting this app and it will not be compatible with the latest version of Splunk 8.0. 

End of support and end of life for the Splunk App for ServiceNow are effective October 31, 2020. 

If you’ve enjoyed using this app, don’t worry because you can still reap the benefits through an alternative method by importing Simple XML Dashboards into your Splunk instance,available in this document for visualizations of your data.

Dashboards can be imported by:

1. Going to Search and Reporting App
2. Clicking on Dashboards
3. Clicking ‘Create New Dashboard’ (fill in the required fields)
4. Clicking on Source tab in ‘Edit Dashboard’ mode
5. Pasting the XML code for the Dashboard that you want to visualize available in this document
    

Pre-Requisites

Before using the XML code, please make sure you follow best practices to configure your Splunk instance for optimized results. Failure to do so will result in adverse performance impact.

1. Splunk recommends customers optimize search to ensure better results. For example, the following search would require attention based on your environment and configuration: <query>index=* action=blocked | timechart partial=f span=1m count | eval value=count*101 
2. Instead of index=* please configure or create the index as per your organization’s requirement
3. Base Search inside of a Panel --> It needs to be moved to be prior to all of the Inputs and Panels being laid out. It’s considered “Best Practice” to place any Base Search at the very top of the Dashboard in the Source Code — here is an example.
    

If you have any questions regarding this announcement, please feel free to reach out to your Splunk Sales Representative. 

----------------------------------------------------
Thanks!
Rahul Mehta