Getting Data In

How to integrate Splunk with servicenow without duplicate table records?

abhishekroy168
Path Finder

Hi all,
I have integrated splunk with servicenow to get all tables from servicenow.
Recently I observed that whenever I am updating a table in servicenow i get 2 copies of it in Splunk .
I mean whenever there is an update for a table in servicenow for N number of times I am getting N numbers of a table in Splunk even though there is only 1 table in servicenow.
Please do help if any of you have any leads regarding this:)

0 Karma

jslay_splunk
Splunk Employee
Splunk Employee

This is expected behavior. You get a copy of every "state" of the record in splunk. You should just look at the latest record to get the most updated information. You can do this with |dedup sys_id

0 Karma

abhishekroy168
Path Finder

thanks @jslay for the answer.
I have done the same thing using distinct_count.
But I need something OOTB which can do it during the process of data plucking from servicenow.
Because using dedup for every query will make it fuzzy:)

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...