Not a DB Connect solution. But I do have created an app on splunkbase to pull data out of Neo4j into Splunk (https://splunkbase.splunk.com/app/5495/). Working on another app that can send Splunk data back to Neo4j (https://splunkbase.splunk.com/app/5508/). ... View more

Although the question is very old and probably not relevant anymore. At least I do have created an app on splunkbase to pull data out of Neo4j into Splunk (https://splunkbase.splunk.com/app/5495/). Working on another app that can send Splunk data back to Neo4j (https://splunkbase.splunk.com/app/5508/). ... View more

I'm the creator of the CMDB-to-ITSI app. I also have experience with the uCMDB. If you're looking for an efficient and functional ServiceNow to Splunk integration (also CMDB) take a look at: https://www.thedutchdatadifference.nl/splunk-servicenow/ I created that solution and continuously adding new features. I potentially can do the uCMDB to my solution so that you can make use of content and context from Splunk. Indeed I can imagine that Splunk is having nice and rich fresh data that can be integrated to a CMDB. ... View more

If you're looking for an efficient and functional ServiceNow to Splunk integration (also CMDB) take a look at: https://www.thedutchdatadifference.nl/splunk-servicenow/ I created that solution and continuously adding new features. You can easily extend the solution to add custom tables. ... View more

Been there done that with the lookups to hold CMDB info. But I ended up to develop a solution. If you're looking for an efficient and functional ServiceNow to Splunk integration (also CMDB) take a look at: https://www.thedutchdatadifference.nl/splunk-servicenow/ I created that solution and continuously adding new features. With this solution you can really query individual nodes but also all sorts of relationships. ... View more

I think it is better to import network communcation logs and then update them in my solution. If you're looking for an efficient and functional ServiceNow to Splunk integration (also CMDB) take a look at: https://www.thedutchdatadifference.nl/splunk-servicenow/ I created that solution and continuously adding new features. It is meant to host all sorts of nodes and relationships. And I can imagine that the network communication logs can be one of them. And then even combine with what is already defined in CMDB. ... View more

If you're looking for an efficient and functional ServiceNow to Splunk integration (also CMDB) take a look at: https://www.thedutchdatadifference.nl/splunk-servicenow/ I created that solution and continuously adding new features. One of the use cases I have done is comparing data available in Splunk with what is in CMDB. ... View more

If you're looking for an efficient and functional ServiceNow to Splunk integration (also CMDB) take a look at: https://www.thedutchdatadifference.nl/splunk-servicenow/ I created that solution and continuously adding new features. One of the use cases I have done is comparing data available in Splunk with what is in CMDB. ... View more

Just to answer. The add-on will replicate the whole ci if the sys_updated_on time is changed. But if you're looking for a functional and efficient ServiceNow CMDB to Splunk integration take a look at: https://www.thedutchdatadifference.nl/splunk-servicenow/ I created that solution and continuously adding new features. Interested to learn about your use case.   ... View more

This is why I developed a solution to overcome the problem of lookups and/or indexes and/or complex searches. My solution is using a Neo4j graph database in between the source of the information and Splunk. The good thing of the graph database is that it is capable of searching for relationships or the lack of relationships. So you can even combine several sources to give you the context that you need. I'm triggered for the CMDB word. And with my solution it becomes much much more easy. I wrote a post about that recently: SOCs: why they struggle with context  ... View more

This is why I developed a solution to overcome the problem of lookups and/or indexes and/or complex searches. My solution is using a Neo4j graph database in between the source of the information and Splunk. The good thing of the graph database is that it is capable of searching for relationships or the lack of relationships. So you can even combine several sources to give you the context that you need. My solution is based on automatically getting in ALL CMDB CI's and relationships into the graph database which then can be search from Splunk. And for that I developed new search commands. I wrote a post about that recently: SOCs: why they struggle with context  ... View more

This is why I developed a solution to overcome the problem of lookups and/or indexes and/or complex searches. My solution is using a Neo4j graph database in between the source of the information and Splunk. The good thing of the graph database is that it is capable of searching for relationships or the lack of relationships. So you can even combine several sources to give you the context that you need. I wrote a post about that recently: SOCs: why they struggle with context  ... View more

This is why I developed a solution to overcome the problem of lookups and/or indexes and/or complex searches. My solution is using a Neo4j graph database in between the source of the information and Splunk. The good thing of the graph database is that it is capable of searching for relationships or the lack of relationships. So you can even combine several sources to give you the context that you need. I wrote a post about that recently: SOCs: why they struggle with context  ... View more

This is why I developed a solution to overcome the problem of lookups and/or indexes. My solution is using a Neo4j graph database in between the source of the information and Splunk. The good thing of the graph database is that it is capable of searching for relationships or the lack of relationships. So you can even combine several sources to give you the context that you need. I wrote a post about that recently: SOCs: why they struggle with context  ... View more

This is why I developed a solution to overcome the problem of lookups and/or indexes. My solution is using a Neo4j graph database in between the source of the information and Splunk. The good thing of the graph database is that it is capable of searching for relationships or the lack of relationships. So you can even combine several sources to give you the context that you need. I wrote a post about that recently: SOCs: why they struggle with context  ... View more

I have done some research and somehow the installation of the SAI 2.0 was not completely correct. I had done the first installation by using winunzip and then copy the uncompressed SAI 2.0 to a folder for our deployer repository. After this I was in the assumption that everything was working correctly which was not true. Now i uncompressed the SAI 2.0 using tar directly within our deployer repository and now it just works as it should. So the investigate tab is showing results. ... View more

I run this query on the SHC SE 7.3.1.1 with SAI 2.0 and no results at all (last 7 days), so it looks like some processes are not running at all. About environment: We do run one IDXC SE 7.3.1.1 with the SAI_TA 2.0 installed. We have one SHC SE 7.3.1.1 running the SAI 2.0 app, the one that this post is about. We have one SH SE 7.3.1.1 running ITSI 4.3.1 and as such SAI 1.4.1 and I do see now also the SAI-TA 1.4.1 installed. But regarding to docs the SAI-TA doesn't need to be on the SH's but only on indexers or heavy forwarders. Then we have a couple of HF SE 7.3.1.1 with the SAI-TA 2.0 installed and configured to use HEC with the following configuration: [http://em_metrics] connection_host = ip disabled = 0 index = em_metrics indexes = em_metrics queueSize = 1MB description = Metrics data for the Splunk App for Infrastructure token = <here is a valid token> sourcetype = em_metrics The collectd agent is manually installed and configured according to the documentation. On the ITSI SH this Linux server is visible within the investigate. But on the SHC (running SAI 2.0) not. ... View more

Thanks this is really a helpful answer. This wasn't clear from the description on splunkbase. ... View more