https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-collect-from-custom-tables-using-the-Service-Now-Add-on/m-p/452191#M55609 <P>Hi all,</P> <P>In the previous version, I had a number of inputs set up to collect from custom tables. This was mostly to enrich data from the CMDB so we can use this in Splunk for various reasons.</P> <P>In version 4.0,0, it looks like the collection from custom tables has been disabled and limited to just 23 tables, as per <A href="https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Configureinputs">https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Configureinputs</A>. </P> <P>I tried just manually updating inputs.conf and hoping for the best, but this doesn't seem to work. Example below:</P> <PRE><CODE>[snow://alm_hardware] duration = 900 account = SNow PROD timefield = sys_updated_on id_field = sys_id disabled = 0 index=snow since_when = 2019-08-16 09:25:37 </CODE></PRE> <P>Does anyone have any insight into what I need to do to get this to work properly?</P> <P>Thanks!</P> Fri, 16 Aug 2019 10:39:59 GMT althomas 2019-08-16T10:39:59Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-collect-from-custom-tables-using-the-Service-Now-Add-on/m-p/452191#M55609 <P>Hi all,</P> <P>In the previous version, I had a number of inputs set up to collect from custom tables. This was mostly to enrich data from the CMDB so we can use this in Splunk for various reasons.</P> <P>In version 4.0,0, it looks like the collection from custom tables has been disabled and limited to just 23 tables, as per <A href="https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Configureinputs">https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Configureinputs</A>. </P> <P>I tried just manually updating inputs.conf and hoping for the best, but this doesn't seem to work. Example below:</P> <PRE><CODE>[snow://alm_hardware] duration = 900 account = SNow PROD timefield = sys_updated_on id_field = sys_id disabled = 0 index=snow since_when = 2019-08-16 09:25:37 </CODE></PRE> <P>Does anyone have any insight into what I need to do to get this to work properly?</P> <P>Thanks!</P> Fri, 16 Aug 2019 10:39:59 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-collect-from-custom-tables-using-the-Service-Now-Add-on/m-p/452191#M55609 althomas 2019-08-16T10:39:59Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-collect-from-custom-tables-using-the-Service-Now-Add-on/m-p/452192#M55610 <P>Solution:<BR /> I was missing the table parameter, now it works!</P> <P>Full config for this entry:<BR /> [snow://alm_hardware]<BR /> duration = 900<BR /> account = SNow PROD<BR /> timefield = sys_updated_on<BR /> id_field = sys_id<BR /> disabled = 0<BR /> index = snow<BR /> since_when = 2019-08-16 09:25:37<BR /> table = alm_hardware</P> Wed, 30 Sep 2020 01:47:11 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-collect-from-custom-tables-using-the-Service-Now-Add-on/m-p/452192#M55610 althomas 2020-09-30T01:47:11Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-collect-from-custom-tables-using-the-Service-Now-Add-on/m-p/547508#M65359 <P>If you're looking for an efficient and functional ServiceNow to Splunk integration (also CMDB) take a look at:&nbsp;<A href="https://www.thedutchdatadifference.nl/splunk-servicenow/" target="_blank" rel="nofollow noopener noreferrer">https://www.thedutchdatadifference.nl/splunk-servicenow/</A></P><P>I created that solution and continuously adding new features. You can easily extend the solution to add custom tables.</P> Sat, 10 Apr 2021 15:11:53 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-collect-from-custom-tables-using-the-Service-Now-Add-on/m-p/547508#M65359 lekanneer 2021-04-10T15:11:53Z