topic How to integrate Splunk with servicenow without duplicate table records? in Getting Data In

How to integrate Splunk with servicenow without duplicate table records?

abhishekroy168 — Tue, 24 Apr 2018 14:28:21 GMT

Hi all,
I have integrated splunk with servicenow to get all tables from servicenow.
Recently I observed that whenever I am updating a table in servicenow i get 2 copies of it in Splunk .
I mean whenever there is an update for a table in servicenow for N number of times I am getting N numbers of a table in Splunk even though there is only 1 table in servicenow.
Please do help if any of you have any leads regarding this:)

Re: How to integrate Splunk with servicenow without duplicate table records?

jslay_splunk — Thu, 26 Apr 2018 13:14:20 GMT

This is expected behavior. You get a copy of every "state" of the record in splunk. You should just look at the latest record to get the most updated information. You can do this with |dedup sys_id

Re: How to integrate Splunk with servicenow without duplicate table records?

abhishekroy168 — Fri, 27 Apr 2018 05:10:45 GMT

thanks @jslay for the answer.
I have done the same thing using distinct_count.
But I need something OOTB which can do it during the process of data plucking from servicenow.
Because using dedup for every query will make it fuzzy:)