{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":30901,"path":"it-operations-management/health-log-analytics/il-connector-hla-splunkpoll-fields.md","title":"Splunk Poller integration configuration fields","bundle":null,"doc_type":null,"release":"australia","body":"\n# Splunk Poller integration configuration fields\n\nDescription of the fields on the Splunk Poller integration configuration forms for Health Log Analytics.\n\nFor the Splunk Poller integration setup procedure, see [Set up a Splunk Poller integration for Health Log Analytics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/health-log-analytics/il-connector-hla-splunk-polling.md).\n\n<table id=\"table_fhy_yq1_m2c\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nIntegration Name\n\n</td><td>\n\nUnique name of this integration. This field is required.**Note:** When you fill in this field, the generic name displayed on the form adjusts automatically to match the name you entered.\n\n</td></tr><tr><td>\n\nExecute on\n\n</td><td>\n\nOption to select whether to use a specific MID Server or a MID Server cluster. This field is required.\n\n</td></tr><tr><td>\n\nMID server name\n\n</td><td>\n\n\\(Only when the **Execute on** field is set to Specific MID Server\\)\n\nMID Server to which log data from Splunk is pulled. This field is required.**Note:**\n\n-   You can select only MID Servers that support basic authentication. MID Servers that support mTLS are not listed.\n-   The default maximum number of data inputs streaming logs to a single MID Server is 10. You can modify this number in the MID Server properties.\n-   If log ingestion is not enabled for the selected MID Server, Health Log Analytics enables it automatically.\n\n</td></tr><tr><td>\n\nMID Server Cluster\n\n</td><td>\n\n\\(Only when **Execute on** is set to Specific MID Server cluster.\\)\n\nThe MID Server cluster to which the log data is pulled. This field is required.The data input runs on a single MID Server in the cluster until that MID Server fails. The system then moves all the data input tasks to the next available MID Server in the cluster according to the configured order.\n\n**Note:**\n\n-   Health Log Analytics supports only failover MID Server clusters. In these clusters, multiple MID Servers are grouped together for failover protection. When selecting a cluster from the data input or integration form, the MID Server clusters list displays only failover clusters.\n-   Log ingestion must be enabled for each MID Server in the cluster. If log ingestion is not enabled for the active MID Server, Health Log Analytics enables it automatically.\n-   The default maximum number of data inputs or integrations streaming logs to a single MID Server is 10. A cluster passes capacity validation if it contains at least one MID Server with fewer than 10 data inputs or integrations running on it. This is true even when that MID Server is down.\n\nFor more information about MID Server clusters, see [Configure a MID Server cluster](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/servicenow-platform/t_ConfigureAMIDServerCluster.md).\n\n</td></tr><tr><td>\n\nService instance\n\n</td><td>\n\nThe service instance \\(formerly the application service\\) to which to bind the log data. This field is required.\n\n</td></tr><tr><td>\n\nData source\n\n</td><td>\n\nThe source of the log data that the integration pulls to your ServiceNow instance: Splunk. This field is read-only.\n\n</td></tr><tr><td>\n\nDescription\n\n</td><td>\n\nOption to add a brief description of the integration to help identify it.\n\n</td></tr></tbody>\n</table><table id=\"table_ns2_1r1_m2c\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nREST API Server URL\n\n</td><td>\n\nThe URL used to access the Splunk REST API. This field is required.**Note:**\n\n-   By default, the Splunk REST API endpoint is available on port 8089. Therefore, the default endpoint for the Splunk REST API is: `http://<splunk-server>:8089`.\n-   The REST API endpoint is different from the front-end endpoint.\n\n</td></tr><tr><td>\n\nAuthentication method\n\n</td><td>\n\nThe credential alias to be used. This field is required.The Splunk integration uses credential aliases instead of direct references to credentials for authentication. The credential aliases are listed by type: aliases that contain basic auth credentials, and those that contain token auth credentials. If an alias holds both credential types, it appears in both categories.\n\nYou can select **Manage credential aliases** to manage your credential aliases and create new ones in the **Connection &amp; Credential Aliases** list.\n\n</td></tr><tr><td>\n\nQuery\n\n</td><td>\n\nThe query Splunk uses to search your data. This field is required.For example, the query `sourcetype=\"adc_access_log\"` instructs the Splunk Poller integration to retrieve all logs with the source type adc\\_access\\_log.\n\n</td></tr></tbody>\n</table>|Field|Description|\n|-----|-----------|\n|Max documents per query|The maximum number of documents retrieved each time log data is fetched from Splunk. Default: 10,000.|\n|Splunk Request Timeout \\(seconds\\)|The maximum time, in seconds, allowed for data retrieval before the request times out.|\n\n**Parent Topic:**[Integration configuration fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown)\n\n"}}