Splunk Add-on for ServiceNow: how to customize the default fetch record counts for respective table. Default value is set to 1000, need to reduce to 50

[AnilPujar]

how to customize the default fetch record counts for respective table in service now add-on.

Default value is set to 1000, need to reduce to 50

Since our service now data is huge, splunk is getting failed to fetch and parse the data.

I found the below code inside add-on, if I edit the default value, it will apply to all tables, How to set default value for specific table.

In globalConfig.json
....
{
"field": "record_count",
"label": "Record Count",
"type": "text",
"help": "Enter the maximum number of records to be fetched at each call to the database table.",
"defaultValue": 1000,
"options": {
"display": false
},
"validators": [
{
"type": "regex",
"pattern": "^[0-9]*$",
"errorMsg": "Record count should only comprise of digits."
}
]
},

....

[hkubavat_splunk · Accepted solution]

You can define the record_count parameter in the splunk_ta_snow_account.conf for each account stanza. i.e. record_count = 50

[deepsecmx]

is there a way to set also the sysparm_offset parameter?

[AnilPujar]

https://********.service-now.com/api/now/table/sc_req_item?sysparm_display_value=all&sysparm_limit=1000&sysparm_exclude_reference_link=false&sysparm_query=sys_updated_on>=2019-09-25+08:45:14^ORDERBYsys_updated_on

sysparm_limit=1000 --> want to reduce this limit.

ERROR pid=11996 tid=Thread-4 file=snow_data_loader.py:collect_data:137 | Failed to get records from https://********.service-now.com/sc_req_item