Splunk Add-on for ServiceNow: How to Customise hostname for the Splunk URL sent to ServiceNow

Available Languages

Updated:September 29, 2026
Document ID:SPLK046611

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Apps and Add-ons Splunk Enterprise

Description

Use a custom hostname for the Splunk URL instead of the default name for the Splunk Add-on for ServiceNow alerts.


Investigation

> By default the URL that is sent in the alerts for the splunk add-on for ServiceNow is as below:
https://<host>:8000/app/search....
> Instead of the <host> which would be the host name for the machine, need to use a separate name
> The Splunk URL is derived from the snow_incident_m.py file


Resolution

Default the hostname in alert_actions.conf to the desired one as mentioned below:

hostname = [protocol]<host>[:<port>]
* The hostname in the web link (URL) that is sent in alerts.
* This value accepts two forms:
  * hostname
       examples: splunkserver, splunkserver.example.com
  * protocol://hostname:port
       examples: http://splunkserver:8000, https://splunkserver.example.com:443

Splunk Document for alert_actions.conf

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products