All Apps and Add-ons

ServiceNow User / Custom View Ingestion

willadams
Contributor

I have a working connection with ServiceNow and can pull data from the database based on my inputs.  However one thing I am trying to do is pull down information related to a custom database view that is not a database table that would normally be found in the SNOW database.  For example I have a custom view called u_customview_splunk.  Is there a way to pull down a custom view from ServiceNow with the current TA?  I  have tried configuring the input as follows

 

[snow://u_customview_splunk]
account = servicenowaccount
duration = 60
id_field = sys_id
index = snow_index
since_when = 2000-01-01 00:00:00
table = u_customview_splunk
timefield = sys_updated_on
disabled = 0

 

Is there another variable that can be called (i.e. instead of "table = xxxxx", something like "view = ......").  I haven't seen this yet in the doco.  

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...