---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Install and configure

# Install and configure Splunk Enterprise Security Notable Event Ingestion integration {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Install and configure Splunk Enterprise Security Notable Event Ingestion integration for Security Operations application from the ServiceNow Store on your ServiceNow AI Platform® instance.

## Before you begin

Role required: ess_analyst

Assign a Security Analyst (ess_analyst) user role in Splunk ES to perform all integration-related activities on the Splunk server.

## About this task

## Procedure

1. If you have not installed the Splunk Enterprise Security Event Ingestion application from the ServiceNow Store for the integration, see [Install a Security Operations integration](https://servicenow-prod.fluidtopics.net/dIzJWROPdytPu1FmtvPx3w "All ServiceNow integrations are available on the ServiceNow Store. Core applications, such as Security Incident Response, are visible in the ServiceNow Products tab on the store. Integration add-ons are visible in the Certified Apps tab.") and follow the steps to install it.
2. After you have successfully installed the application, navigate to AllSecurity OperationsIntegrationsIntegration Configurations.
3. Search for Splunk Enterprise Security- Event Ingestion tile, and select Configure.
4. On the form, fill in the fields.

   | Field | Description |
   | Name | Name of the Splunk Enterprise Security console or Splunk Cloud instance used for the integration. Spaces are supported for names, but parentheses are not supported. For example, enter <kbd class="ph userinput">SplunkES2</kbd>. |
   | Splunk API Base URL | URL for your Splunk Enterprise Security console or Splunk Cloud instance. The URL should include the API port, for example: `https://mysplunkserver.com:8089` |
   | Basic Authentication | Default is disabled. If you are using API Account User Name and API Password for configuration, enable the check box. |
   | API Account User Name | User name that you created for your API user account on the Splunk Enterprise Security console. |
   | API Password | Password that you created for your API user account on the Splunk Enterprise Security console. |
   | Token Based (available from version 12.0.0) | Token that you created for your API user account on the Splunk Enterprise Security console. |
   | Token | Token that you created for your API user account on the Splunk Enterprise Security console. |
   | On Premises Deployment | Default is disabled. If you're using an on-premise based version of Splunk Enterprise Security, verify that this check box is selected. |
   | MID Server | Option to choose a particular MID Server to set up in your environment, which will be used by this integration to pull notable events into ServiceNow. You can select a specific MID Server from the list or select Any to enable an auto-selection of a valid MID Server from the list for this integration. Note: * The MID Server selected during this configuration time applies throughout this integration. * Only MID Servers that are active and validated are displayed on this list. By default, the value is set to Any. {#splunk-event-ingest-install-and-configure-security__ul_ivm_g2q_byb} For example, there are three MID Servers A, B, and C. If you select Any, then one of these MID Servers is auto-selected and applies throughout this integration. If you select a specific MID Server, say C, then the selected MID Server C applies throughout this integration. If you want to change the MID Server, then you have to reconfigure it from the App Configuration tile. |
   |-|-|

   {#splunk-event-ingest-install-and-configure-security__choicetable_rrp_bwk_kdb}  
   Each Splunk Enterprise Security notable event type that you ingest from your Splunk Enterprise Security incident review console requires a unique event profile in your ServiceNow AI Platform® instance. However, the source that you configure on the Event Ingestion Configuration form can be reused for multiple ServiceNow AI Platform® profiles as long as each profile ingests unique notable event types.
5. Select Submit.  
   The configured integration tile displays.
{#splunk-event-ingest-install-and-configure-security__steps_rvh_qsv_3fb}

## What to do next

[Create and name an event profile for the Splunk Enterprise Security event ingestion integration](https://servicenow-prod.fluidtopics.net/v9spPHbKI2udP0VNrCxkhw "You create an event profile in your ServiceNow AI Platform instance and determine which Splunk notable events create security incidents.")

*[\>]: and then