ServiceNow Inputs.conf Filter Data by field value

[brdr]

We use the Splunk ServiceNow TA - both on collecting data from ServiceNow and creating incidents via the Splunk alert action.  

We have use case on the collection side. Within the inputs.conf there is attribute available call filter_data. This allows you to filter on the data you wish/not wish to collect from ServiceNow. The specific use case is where we do NOT want to collect events from sys_audit table if sys_created_by=user. System. 

The basic stanza attributes in inputs.conf within the Snow TA  is this:

[snow://sys_audit]
filter_data = sys_created_by!=user.system
table = sys_audit

This approach does not filter sys_created_by, that is, we still see user.system as sys_created_by in our events. 

Is there anything I'm doing wrong? Thx. 

[johnhuang]

The filter only support inclusion but not exclusion. That means you can specify it to only collect events matching the filter.

You can setup SEDMD to drop the event to prevent it from being indexed.

[brdr]

Thank you Johnhua for the note about inclusion vs. exclusion. Although i think SEDCMD might work we have decided to go with dropping the event into null queue using props and transforms. Thanks again.