How can I onboard SNOW RITM variables data to splunk

epari1437 — Thu, 17 Jun 2021 12:00:17 GMT

Requirement is to onboard SNOW RITM variables data to Splunk. Using table name SC_REQ_ITEM and SC_TASK, I can able to fetch data except variables.

Can anyone suggest how can I fetch data for variables which are linked to the catalog item/task.

My event would be :

You are requesting for: value

your name: value

select system: laptop

Re: How can I onboard SNOW RITM variables data to splunk

ismedley — Thu, 17 Jun 2021 16:30:49 GMT

Splunk's add-on for ServiceNow would do this for you - you'd need to manually edit its inputs.conf to create an ingestion for the sc_req_item table as that one isn't included out the box.

Failing that, the add-on creates a query of the format

https://<????>.service-now.com/api/now/table/sc_req_item?sysparm_display_value=all&sysparm_offset=0&sysparm_limit=1000&sysparm_exclude_reference_link=true&sysparm_query=sys_updated_on%3E=<earlier_timestamp>^sys_updated_on%3C<later_timestamp>^ORDERBYsys_updated_on,sys_id

which will resolve the lookup fields for the record. The sysparm_fields parameter can be used to restrict the fields returned

topic Re: How can I onboard SNOW RITM variables data to splunk in Getting Data In

How can I onboard SNOW RITM variables data to splunk

Re: How can I onboard SNOW RITM variables data to splunk