Splunk Alerts getting triggered to ServiceNow using Splunk Add-on for Service Now gets truncated

[spl_unker]

Hi Splunkers

Im using "Splunk Add-on for Service Now"  to send  triggered alerts to servicenow.

Im trying to pass the alert name , alert time to the short description field in service now. In Service now i see the results populated but it gets truncated exactly at 80 character . 

I checked with service-now team as well in my organisation and they dont have any such limit at their end.

Additionaly when i checked the add-on i see the index_lenght =80 check has been used in the addon code. will this could be the reason behind the results getting trucated. Any one else faced this issue?

Code Snippet :

#

# SPDX-FileCopyrightText: 2021 Splunk, Inc. <[email protected]>

# SPDX-License-Identifier: LicenseRef-Splunk-8-2021

#

#

APP_NAME = "Splunk_TA_snow"

DEFAULT_RECORD_LIMIT = 3000

DEFAULT_DISPLAY_VALUE = "false"

FIELD_SEPARATOR = "||"

INDEX_LENGTH = 80

FILTER_PARAMETER_MIGRATION_STANZA = "filter_parameter_migration"

SETTINGS_CONF_FILE = "splunk_ta_snow_settings"

CHECKPOINT_COLLECTION_NAME = "Splunk_TA_snow_inputs_checkpointer"

[AbuMehran]

Hope this finds you helpful.

https://splunk.my.site.com/customer/s/article/When-creating-an-incident-from-ServiceNow-short-descri...

[Rajiv_splunk]

HI @spl_unker  we are facing a similar issue what you faced a year ago. Our short description is also getting truncated after 80 character and when i checked the code snippet it has same details as you shown in your post.

FIELD_SEPARATOR = "||"
INDEX_LENGTH = 80

DID YOU FOUND THE ANSWER FOR THIS. IS THIS HAS ANYTHING TO DO WITH THE INDEX_LENGTH. Should we change the index length and redeploy. Your answer on this will be highly appreciated