- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk Add-on for ServiceNow: Is it possible to add more columns to results returned by the snoweventstream command?

When running the |snoweventstream
command it returns the columns: "Time of the event", "_time","State","Source","Event Link","Node","Severity","Resource","Type" and "Sys Id". Is there a way to add more columns to the results returned?
For example, in my search, I am looking for PCName. What I would like to do is, when I run the |snoweventstream
command, have it return these results.
"Time of the event", "_time","State","Source","Event Link","Node","Severity","Resource","Type","Sys Id" and "PCName"
Is that possible?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

We are limited by what ServiceNow Api returns.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

So I forgot to add this to my first question. The reason behind wanting to do this is when i send out an email from the alert that contains the |snoweventstream command the fields that i want to send in the email are not part of the returned results so the emails just end up as blank.
So in this example if I put PC name = $result.PCName$ in the email it ends up as PC Name =
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

So there is no way to concatenate Splunk search results with the Servicenow results?
something like | snoweventstream PCname or |snoweventstream." ".PCname or a similar command?
