All Apps and Add-ons

Splunk Add-on for ServiceNow: Is it possible to add more columns to results returned by the snoweventstream command?

nhicks
Explorer

When running the |snoweventstream command it returns the columns: "Time of the event", "_time","State","Source","Event Link","Node","Severity","Resource","Type" and "Sys Id". Is there a way to add more columns to the results returned?

For example, in my search, I am looking for PCName. What I would like to do is, when I run the |snoweventstream command, have it return these results.
"Time of the event", "_time","State","Source","Event Link","Node","Severity","Resource","Type","Sys Id" and "PCName"

Is that possible?

0 Karma

ehaddad_splunk
Splunk Employee
Splunk Employee

We are limited by what ServiceNow Api returns.

0 Karma

nhicks
Explorer

So I forgot to add this to my first question. The reason behind wanting to do this is when i send out an email from the alert that contains the |snoweventstream command the fields that i want to send in the email are not part of the returned results so the emails just end up as blank.

So in this example if I put PC name = $result.PCName$ in the email it ends up as PC Name =

0 Karma

nhicks
Explorer

So there is no way to concatenate Splunk search results with the Servicenow results?

something like | snoweventstream PCname or |snoweventstream." ".PCname or a similar command?

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...