Why is the Splunk App for ServiceNow returning IDs in JSON format?

[wegscd]

Our ServiceNow instance is actually returning a JSON structure instead of just an ID for things like assignment groups, caller ids, etc.

Our sales engineer is seeing this in his demo instance:

cmdb_ci="27e3a47cc0a8000b001d28ab291fa65b"

From our instance, I get:

cmdb_ci="{u'value': u'75bfce366fed8500f2526d6eae3ee4e5', u'link': u'https://whirlpool.service-now.com/api/now/table/cmdb_ci/75bfce366fed8500f2526d6eae3ee4e5'}"

Has anyone else seen things in the JSON format (and worked around it)?

[ehaddad_splunk · Accepted solution]

Hi,

This is a defect in the TA that should be fixed in our next maintenance release.
Thanks,

[bawood]

Any ETA on the maintenance release to fix this issue?

[wegscd]

here's the workaround until we see the fix from Splunk:

Update line 195 in snow_data_loader.py to be:
params = "?sysparm_exclude_reference_link=true&sysparm_query={}".format(params)

By adding the sysparm_exclude_reference_link=true parameter SN returns the expected result.

[wegscd]

any way to get a patch earlier? I'm dead in the water here; I either have to modify all the queries, or else go in and fix the TA myself. The fix looks straightforward....

[wegscd]

never mind. SE forwarded patch to me.