Monitoring Splunk

Splunk Addon for Service Now - Filter Parameters

vik_splunk
Communicator

Hi All,

A few questions pertaining the Splunk Addon for ServiceNow

Context: We are trying to setup exclusion filter parameters to ingest only selective data from certain tables from our SNow instance.

The documentation at present is not very comprehensive with examples of how to do what we need.

https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Configureinputs

Filter parametersEnter filters, in key-value pairs for indexing selected data from the table. For example, key1=value1&key2=value2. By default, there is no filter.

 

Below are the questions.

  1. How do we add exclusion filters  For example sys_id!=abc. I tried using ! but doesn't appear to be working
  2. Do multiple filters have to be separated by & or , or AND.
  3. How do we encode values with spaces. For instance, let's say we are trying to apply a filter sys_id=abc def. Should that be sys_id="abc def" OR as is without spaces. I checked the debug log and the TA seems to be URL encoding spaces with a + but would be worth if that is confirmed.

 

At present, it appears as thought the above tested filters are being ignored.

Appreciate any inputs. Thanks!

Labels (1)

ddvali
Explorer

I also same kind of issues .

@vik_splunk  Do you found a solution for this ?

0 Karma

RMcCurdyDOTcom
Explorer

Looking into this now ... I have dumped a sample of every single table and trying to figure out the API and filters as we have null values for like 90% of our asssets in SNOW so I need to filterout and some how bind IP <> Owner .. some notes ... 
 

 

roll thouth all the tgables "get the table names in the UI by going to report crate page ... and looking at the source 

curl -s -H "Accept: application/json" -u "XXXXXXXXXXXXXX:XXXXXXXX" "https://YOURCOMPANEYNAME.service-now.com/api/now/table/${i}?sysparm_display_value=all&sysparm_offset=${j}&sysparm_limit=1000" -o "${i}_out${j}.json"

look for non null values for each key ? ( for me YMMV )
grep -E "(\bip.address\b|\bsupport.group\b|owned_by\b|\bsys_class_name\b|\blocation\b|\bsys_class_name\b|\bdns_domain\b|\bsys_domain\b|\bfqdn\b|\bbusines_criticality\b|\bclass_name\b|\boperational_status\b|\bcreated_by\b|\bassignment_group\b|\bassigned_to\b|\bsvc_service_id\b)" Pretty_* -A 1


Working on filtering like &not%20owned_by="" or something .. I have no idea hopfuly sometihng on github that uses this API with filtering so ill post or mesg me 

- rmccurdy.com
0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...