I am working with Splunk and Service Now... within Service Now we are able to pass variable field values by using the following notation:
$result.my_cool_field$
So, if an event severity could change based on certain things... I may have SPL logic that creates a field named "event_severity" that can be anywhere between 1-4...
I then want to generate an alert within Splunk and have that open up an incident within Service Now... which I can have the incident severity change by putting the variable of $result.event_severity$.
This works great!
Now I am creating some dashboards that will help look through all of our alerts and dump out titles, severity, permissions, etc...
I am using the rest API to bring back the data... which works great, except that some of the alert severity values have been set at specific values (ie: "1", "2", etc)... and then some are variable, so the value is not a number, but instead a variable mentioned above ($result.event_severity$).
The issue that I am running into, is that when I pull in all of the alerts, along with their severities... it is causing issues in the dashboard due to the field name being wrapped in Dollar Symbols ("$").
The dashboard then treats these field names as dashboard tokens... and then the dashboard component won't do anything, because it is waiting for "input"... in other words, it is waiting for some value that will never be set, to replace the field name that it thinks is a variable.
Is there any way to escape the dollar symbols within the SPL when I am querying for field names?
| rest /servicesNS/-/-/saved/searches
| search disabled=0 eai:acl.app=my_cool_app severity IN ("1","$result.event_severity$")
I need it to return alerts where severity=1 OR severity=$result.event_severity$... but the dashboard panel won't do it, because it is treating "$result.event_severity$" as a dashboard token.
Any help is very appreciated!
