After recently upgrading to new version of ServiceNow app, we have found that the display value (dv*) field have automatically been enabled. This makes each event/payload quite huge and makes them cumbersome to investigate. Some of the displayvalue fields are quite useful.
We could see the workaround provided per the docs to disable dv_* fields entirely: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Upgrade
So the question is
Can we selectively NOT index certain fields? (For example, we don't need fields like
dv_approval_history from change_request table)
How to select the fields which are not required for indexing?
Yes you can be selective about it. You are looking to filter events out before they are indexed. You'll need to modify
transforms.conf files with some parsing to remove/replace data. Here's some links to get you started.
A gotcha to be aware of is SEDCMD in props.conf comes before Transforms. (hattip: @davidpaper )
Found the answer. This can be done at inputs.conf
[snow://change_request] exclude = description,dv_close_notes,dv_comments_and_work_notes, ......
and so on. unfortunately it have to be done manually as per my testing