Partner Solution Brief

In Partnership With

Break Down Operational Silos and

Accelerate Incident Resolution

Integrate Splunk with ServiceNow to Combat Rising IT Complexity

The Challenge
Todays IT environments are becoming more agile, but they are
also becoming more complex. With cloud and virtualization,
many interconnected technologies now run across private data
centers and public clouds. Each technology creates a new
operational silo, giving IT a fragmented view of their services and
infrastructure. IT is paralyzed by a multitude of disconnected
information, but lacks critical data needed for root cause analysis,
which prolongs troubleshooting and incident resolution times.
Outdated processes, poorly integrated solutions and lack of
automation only make the situation worse.

Service
Management
Discovers and records
enterprise assets
and services
Manages alert lifecycle

ServiceNow discovers enterprise assets and services.

Splunk correlates and analyzes all log data in real-time.

Automates workflow
and remediation
Orchestrates
deployment and
change management

Splunk and ServiceNow understand the need to simplify IT

operations by providing access to meaningful, actionable
information at the right time and with the right context. The
Splunk App for ServiceNow simplifies incident resolution by
breaking down silos, eliminating information gaps and automating
IT processes. As a Splunk customer using the ServiceNow Event
Management application, this solution is available to you at no
additional cost, letting you maximize the value of your Splunk
and ServiceNow investments.

ServiceNow receives only highly qualified Events and Incidents from Splunk.
Splunk tools are leveraged for detailed inspection and troubleshooting.

ServiceNow automates workflow and remediation.

Splunk automatically observes fix and closes alert.

Figure 1 Splunk App for ServiceNow Incident Resolution Process

www.servicenow.com

Operational
Intelligence
Collects, correlates and
analyzes machine data
in real-time
Enables detailed
inspection troubleshooting
and monitoring
Proactively detects
anomalies in data
Enables operational
visibility
Easily scales to meet
enterprise needs

Break Down Operational Silos and Accelerate Incident Resolution

Partner Solution Brief

How It Works
The process starts with ServiceNow discovering your IT
services, applications and infrastructure including public
and private cloud environments. ServiceNow populates
its Configuration Management Database (CMDB) with
corresponding Configuration Items (CIs), along with associated
point-to-point relationships and end-to-end service maps. It
continues to track changes in your IT environment, keeping its
CMDB up to date and accurate.

Available on the ServiceNow Store

The Splunk App for ServiceNow is fully certified by ServiceNow,
and is available on the ServiceNow Store and on Splunkbase.

Splunk continuously collects streaming machine data from your

applications and IT infrastructure, from anywhere including
physical, virtual and cloud environments. It analyzes and
correlates this rich, detailed information, transforming it into
highly qualified and actionable events. It sends these events to
the ServiceNow Event Management application, where they are
associated with specific CIs in the CMDB providing a clear
indication of which IT resources are affected.

For more information, or to schedule a demo, please contact your

ServiceNow or Splunk account team.

After applying optional filtering and correlation, ServiceNow creates appropriate incidents for the events it receives. Your IT staff
can see these incidents and associated events at a glance using
the intuitive ServiceNow Event Management dashboard, and
can also visualize them on interactive business service maps.
They can then directly drill down from ServiceNow into Splunk
software to use Splunks powerful analytics tools to carry out
detailed event inspection and troubleshooting and pinpoint root
cause. For well-characterized events that dont require further
troubleshooting, ServiceNow can also operate in full zero-touch
mode resolving the incident without intervention from
NOC operators.
Once the cause of an event is determined, ServiceNow carries
out automatic remediation. This includes driving manual
remediation workflows, as well as performing automated actions
directly on your IT network such as automatically resetting
servers or provisioning additional storage capacity. Once an
issue is remediated, Splunk can be used to send a clear event
to ServiceNow to close the incident.

Summary
By integrating Splunk with ServiceNow, you can reduce service
downtime and proactively avoid service outages. Use Splunk and
ServiceNow together to simplify IT management, break down
operational silos and accelerate incident resolution.

Splunk: +1 866.GET.SPLUNK
ServiceNow: +1 408.501.8550
About Splunk Inc.
Splunk Inc. (NASDAQ: SPLK) is the market-leading platform that
powers Operational Intelligence. We pioneer innovative, disruptive
solutions that make machine data accessible, usable and valuable
to everyone. More than 10,000 customers in over 100 countries
use Splunk software and cloud services to make business,
government and education more efficient, secure and profitable.
Join hundreds of thousands of passionate users by trying Splunk
solutions for free: http://www.splunk.com/free-trials.
About ServiceNow ITOM
ServiceNow IT Operations Management gives enterprises
complete visibility and control of their entire IT environment
including virtualized and cloud infrastructure. It simplifies service
mapping, delivery and assurance, consolidating IT service and
infrastructure data into a single system of record. It also automates
and streamlines key processes including event, incident,
problem, configuration and change management creating a
complete, consistent and integrated IT operational framework that
drives efficiency and improves service quality.

The Splunk App for ServiceNow also collects detailed

information from the ServiceNow CMDB to import CIs about
users, servers, locations and services. Your IT team can use
Splunk platform to correlate CI information with other machine
data for integrated analysis on changes, resources, risks, events
and incidents.

www.servicenow.com
2015 ServiceNow, Inc. All rights reserved.
ServiceNow believes information in this publication is accurate as of its publication date. This publication could include technical inaccuracies or typographical errors. The information is subject to change without
notice. Changes are periodically added to the information herein; these changes will be incorporated in new editions of the publication. ServiceNow may make improvements and/or changes in the product(s) and/
or the program(s) described in this publication at any time. Reproduction of this publication without prior written permission is forbidden. The information in this publication is provided as is. ServiceNow makes no
representations or warranties of any kind, with respect to the information in this publication, and specifically disclaims implied warranties of merchantability or fitness for a particular purpose.
ServiceNow and the ServiceNow logo are trademarks of ServiceNow, Inc. All other brand and product names are trademarks or registered trademarks of their respective owners.

SN-SB-PartnerSplunk-102015