All Apps and Add-ons

How to apply a filter on events before it gets into Splunk Indexer from ServiceNow based of particular field value ?

New Member

I am using "Splunk app for Servicenow" & "Splunk add-on for ServiceNow" which is integrated with ServiceNow.
I want to extract only those incidents in Splunk indexer (snow) from ServiceNow where "assignment_group" = "XYZ" or "ABC"
Currently it is extracting million of events in Splunk from ServiceNow Incidents.

0 Karma

Splunk Employee
Splunk Employee

Not an option in the add-on itself and not sure if SNOW API allows it. You can add a props entry to filter unwanted incidents and send them to null Queue.

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...