---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Troubleshoot the TISC add-on in Splunk

# Troubleshoot the TISC add-on in Splunk {#ariaid-title1}

* Release version: Australia
* 
* Updated May 26, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Enable debug logging on the add-on, view the resulting log entries in Splunk, and check input execution status from the Input Metadata Lookup KV store.

## Before you begin

Role required: Splunk admin

The TISC add-on is installed and configured. See [Configure TISC add-on in Splunk](https://servicenow-prod.fluidtopics.net/eGDCRjLSe5DcQnmzBfqjVg "Configure the TISC add-on in Splunk to connect your account, define data inputs, and pull observable records into the KV store for search and analysis.").

## About this task

Use this procedure when an input is not pulling observables from TISC as expected, when records appear stale or missing in the KV store, or to inspect the execution history of a configured input.

## Procedure

1. From the add-on, open the Configuration page and select the Logging tab.
2. Set Log level to DEBUG and select Save.  
   Subsequent input runs provide verbose debug statements that can be searched in Splunk.
3. To view the debug entries, run a search in Splunk that scopes to the add-on's internal logs and filters on the `DEBUG` level.  
   For example:

       index=_internal sourcetype=splunkd "TA-threat-intelligence-security-center" log_level=DEBUG

   Refine the search further by input name or time range to narrow the results to a specific run.
4. To verify the execution status of each input, look up the `inputs_metadata_lookup` KV store.  

       | inputlookup inputs_metadata_lookup

   The lookup contains one record per configured input. Each record captures the following fields:
   {#tisc-splunk-troubleshooting__table_input_metadata_fields__entry__2}

   | Field | Description |
   |-|-|
   | configuration_name | Name of the account configuration associated with the input. |
   | historical_fetch_date | Start date used the last time Enable Historical Fetch was set on the input. Empty if a historical fetch has not been run. |
   | historical_fetch_pending | Status indicating whether a historical fetch is pending. |
   | input_name | Name of the input. |
   | last_successful_execution_time | Timestamp of the most recent successful execution of the input. |
   | status | Outcome of the most recent execution: `success` or `failure`. |
   | status_message | Detail message for the most recent execution, including error context if the run failed. |
   |   | . |
   [Table 1. Input Metadata Lookup fields]

   {#tisc-splunk-troubleshooting__table_input_metadata_fields}
5. After you have diagnosed the issue, return to the Logging tab and reset Log level to INFO to stop emitting verbose entries.

## Result

You have collected the diagnostic information needed to identify why an input failed or returned unexpected results. Provide the relevant log entries and the input's metadata record when raising a support case or working with the add-on team.
**Related concepts**   

* [Data storage in Splunk](https://servicenow-prod.fluidtopics.net/IbcEMdLHbvrVXX8GI_TyTA "Configure and retrieve Key-Value store lookups used by TISC during its integration with Splunk.")
* [TISC add-on for Splunk overview](https://servicenow-prod.fluidtopics.net/i6RYKAjFAoLVZWUNgL~gEw "Configure the Threat Intelligence Security Center (TISC) integration with Splunk to import threat intelligence data, set up indicator collections, and analyze search matches using dashboards.")  
**Related tasks**   

* [Configure TISC add-on in Splunk](https://servicenow-prod.fluidtopics.net/eGDCRjLSe5DcQnmzBfqjVg "Configure the TISC add-on in Splunk to connect your account, define data inputs, and pull observable records into the KV store for search and analysis.")