Hi All,
A few questions pertaining the Splunk Addon for ServiceNow
Context: We are trying to setup exclusion filter parameters to ingest only selective data from certain tables from our SNow instance.
The documentation at present is not very comprehensive with examples of how to do what we need.
https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Configureinputs
| Filter parameters | Enter filters, in key-value pairs for indexing selected data from the table. For example, key1=value1&key2=value2. By default, there is no filter. |
Below are the questions.
- How do we add exclusion filters For example sys_id!=abc. I tried using ! but doesn't appear to be working
- Do multiple filters have to be separated by & or , or AND.
- How do we encode values with spaces. For instance, let's say we are trying to apply a filter sys_id=abc def. Should that be sys_id="abc def" OR as is without spaces. I checked the debug log and the TA seems to be URL encoding spaces with a + but would be worth if that is confirmed.
At present, it appears as thought the above tested filters are being ignored.
Appreciate any inputs. Thanks!
