Skip to content
MID-less integrations › Set up integrations from Integrations Launchpad › Set up HLA on your instance › Configuring › Health Log Analytics › ITOM AIOps › IT Operations Management
Release: Australia · Updated: 2026-05-04 · Official documentation · View source

Set up a Cribl Stream (MID-less) integration for Health Log Analytics

Set up a Cribl Stream integration to stream Cribl log data directly to your ServiceNow instance, without a MID Server.

Before you begin

Set up MID-less log streaming via ITOM Gateway. Choose the deployment method based on your expected log volume. For more information, see MID-less log streaming via ITOM Gateway in Health Log Analytics.

Role required: evt_mgmt_admin

About this task

Set up an integration from the Integrations Launchpad in Service Operations Workspace, which you access from the ITOM AIOps configuration center. The AIOps configuration center is a centralized workspace for configuring and managing AIOps features from a single place. The integrations setup process reduces implementation time compared to manual data input setup in the classic interface in Health Log Analytics. For more information, see Integrations Launchpad in Service Operations Workspace for ITOM.

Procedure

  1. Navigate to Workspaces > Service Operations Workspace.

  2. From the Integrate section, under Integrations, select Add integration.

    The Integrations Launchpad appears.

  3. In the Browse integrations tab, search for the Cribl Stream integration and select its tile.

    Note: If you start an integration setup before meeting all prerequisites, a message appears. You can cancel the setup and complete the prior requirements first. Alternatively, you can continue in draft mode and complete the requirements later. Note that you can't activate the integration until you have completed all the prerequisites.

  4. On the Provide details form, fill in the fields and then select Next.

  5. On the Set-up instruction screen, follow the instructions to enable sending Cribl log data to ServiceNow using OpenTelemetry.

    1. Copy the provided access token, endpoint, and integration ID to the clipboard.

      These credentials enable Cribl to securely send logs to the ServiceNow ITOM Gateway.

      CredentialDescription
      Access TokenThe JWT credential passed with every request (servicenow-access-token).
      EndpointThe Gateway gRPC endpoint, the address to which Cribl Stream will send the log data.
      Integration IDThe ID by which the integration identifies to ServiceNow (servicenow-integration-id).

    2. In the Cribl UI or configuration files, depending on your deployment, set up a Cribl destination that uses the OpenTelemetry Protocol (OTLP) to forward data to ServiceNow.

      Note: Cribl integrates directly with ServiceNow via API. No collector or agent is needed.

    3. In Cribl, paste the copied credentials into the destination configuration.

    For more detailed instructions, see the Set up Cribl to send data to HLA without a MID Server [KB2271238] article in the Now Support knowledge base.

  6. On the Cribl Stream integration Set-up instruction screen, complete the integration setup by doing one of the following.

    OptionDescription
    Prerequisites complete — activate with AISelect Activate with AI to enable AI-powered automatic mapping of log data. When the integration is activated successfully, the Overview tab is displayed and Now Assist collects and analyzes log data. An AI icon indicates that Now Assist auto-maps log data to service instances and components for contextual alert generation.
    Prerequisites complete — activate without AISelect Activate to activate the integration without AI-powered mapping. The integration is activated and the Overview tab is displayed.
    Prerequisites not completeSelect Save draft. The system saves the integration as a draft in the Integrations Launchpad Installed integrations tab, under Waiting for your action. You can complete the prerequisites and activate the integration later. For more information, see Activate a draft integration in Health Log Analytics.

What to do next

On the Overview tab, do the following:

Image omitted: more-options.png
More options menu icon.\) to open the **Data Input Mapping**, **Source Type Structures**, or **Log Sources** pages with context from the integration. If your log data is not properly mapped, structured, or sourced, go back and adjust the configuration. If the Service Operations Workspace Log Analytics application is installed, the More options menu also provides direct access to the **Log Viewer**. Use the **Log Viewer** to review raw log messages ingested by the integration. For more information, see:
-   [Log data auto-mapping and mapping](hla-data-input-automapping.md)
-   [Source type structure adjustment](hla-source-type-structure-adjustment.md)
-   [Review alert logs on the Log viewer](hla-op-logs-log-viewer-concept-sow.md)

If you activated the integration with AI, verify that AI correctly auto-mapped log data to service instances and components. To do this, select View mapping under Log context mapping. You can override the AI mapping by selecting a different log field from each list. For more information, see Map logs to service instances, components, source types.

Parent Topic:Set up Health Log Analytics on your ServiceNow instance