Splunk to uCMDB Integration

[mbasharat]

I have been doing some research and need to know if there is any Splunk certified secure app in splunkbase for integrating Splunk to uCMDB OR what is the correct and tested procedure of doing so that we can get data from uCMDB to Splunk e.g. CIs, CI's attributes etc.? I was going thru Splunkbase and found only one app named CMDB-to-ITSI. It is not just indexing the uCMDB logfiles via Splunk. Appreciate your assistance in-advance. Thanks.

[lekanneer]

I'm the creator of the CMDB-to-ITSI app. I also have experience with the uCMDB.

If you're looking for an efficient and functional ServiceNow to Splunk integration (also CMDB) take a look at: https://www.thedutchdatadifference.nl/splunk-servicenow/

I created that solution and continuously adding new features. I potentially can do the uCMDB to my solution so that you can make use of content and context from Splunk.

Indeed I can imagine that Splunk is having nice and rich fresh data that can be integrated to a CMDB.

[stefan_d]

And also what about the other direction?

Is anyone pushing inventory data from Splunk into uCMDB?

Not sure if the use case would make sense from a license cost perspective, but if you're already using a Splunk agent on a server can one not collect inventory type data (say once a week) via Splunk and use uCMDB's REST API to populate the CI in uCMDB? I think this could save the admin effort and license for using uCMDB's universal discovery agent/probe to collect data and update the CI.

I guess it depends on the integration effort. Also, this won't work if more than simple inventory data collection is required..

thoughts?

[ansif · Accepted solution]

For HP uCMDB 11 version REST API is supported,you can use REST API to get all interested data from uCMDB.

[maciep]

we use dbconnect to pull data from our cmdb. As of now, we don't ingest the data, but just run queries against it in splunk. We create an account, cmdb team gives us permissions/views and sql team ensures we're hitting the dr/inactive node, so we can't affect production activity.

[maurelio79]

Hi, in our company we asked to people that managed uCMDB to create a job that get data from uCMDB, write a csv file and then copy the file on a universal forwarder machine via beta48 job, then we configured that universal forwarder to import that csv.

Regards