All Apps and Add-ons

Splunk Add-on for ServiceNow: Is it possible to add more columns to results returned by the snoweventstream command?

nhicks
Explorer

When running the |snoweventstream command it returns the columns: "Time of the event", "_time","State","Source","Event Link","Node","Severity","Resource","Type" and "Sys Id". Is there a way to add more columns to the results returned?

For example, in my search, I am looking for PCName. What I would like to do is, when I run the |snoweventstream command, have it return these results.
"Time of the event", "_time","State","Source","Event Link","Node","Severity","Resource","Type","Sys Id" and "PCName"

Is that possible?

0 Karma

ehaddad_splunk
Splunk Employee
Splunk Employee

We are limited by what ServiceNow Api returns.

0 Karma

nhicks
Explorer

So I forgot to add this to my first question. The reason behind wanting to do this is when i send out an email from the alert that contains the |snoweventstream command the fields that i want to send in the email are not part of the returned results so the emails just end up as blank.

So in this example if I put PC name = $result.PCName$ in the email it ends up as PC Name =

0 Karma

nhicks
Explorer

So there is no way to concatenate Splunk search results with the Servicenow results?

something like | snoweventstream PCname or |snoweventstream." ".PCname or a similar command?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.