Any way to pull data from a custom ServiceNow table and save it permanently without without meeting index data retention policies ?

[nmohammed]

We have a custom table in ServiceNow which just stores data for the Firewall NAT mappings. I added an input in servicenow App to pull data from this table. It was working fine, but since Splunk stores data based on time, it met our retention policies defined for the ServiceNow index and deleted all the data.

What is the best possible way to keep this data stored for ever? It is a small set of records in that table and we want to pull it and save it in Splunk without deleting it due to Index data retention policies.

Name Source IP Target IP
(NAT) xxx.xxx.xxx.200 xx.xxx.xx.xxx

[xpac]

Build a search that returns the data in a format that is good for you. Append | outputlookup your-lookup.csv to the search, which should write the results to a lookup with that name. The data can then later be used as any other lookup with the | lookup and | inputlookup commands.

[ssadanala1]

As mentioned as a small set of data , ideal way is to save as a lookup which wont expire 🙂

Happy Splunking !!

[nmohammed]

Thanks ssadnala1 .

can you please guide me on how to pull that data and save as a lookup ?