We are using the ServiceNow TA to send Splunk data into SNow Event Management. As it stands now, if using the | snowevent at the end of the search, adding "additional_information" could be auto parsed by SNow but instead, it appends "url=" and the data doesn't parse as JSON.
Is there any field we can pass the additional_information that corresponds to what SNow Event Management expects as "additional_information" ?
