Hi All,
A few questions pertaining the Splunk Addon for ServiceNow
Context: We are trying to setup exclusion filter parameters to ingest only selective data from certain tables from our SNow instance.
The documentation at present is not very comprehensive with examples of how to do what we need.
https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Configureinputs
Filter parameters | Enter filters, in key-value pairs for indexing selected data from the table. For example, key1=value1&key2=value2. By default, there is no filter. |
Below are the questions.
At present, it appears as thought the above tested filters are being ignored.
Appreciate any inputs. Thanks!
I also same kind of issues .
@vik_splunk Do you found a solution for this ?
Looking into this now ... I have dumped a sample of every single table and trying to figure out the API and filters as we have null values for like 90% of our asssets in SNOW so I need to filterout and some how bind IP <> Owner .. some notes ...
roll thouth all the tgables "get the table names in the UI by going to report crate page ... and looking at the source
curl -s -H "Accept: application/json" -u "XXXXXXXXXXXXXX:XXXXXXXX" "https://YOURCOMPANEYNAME.service-now.com/api/now/table/${i}?sysparm_display_value=all&sysparm_offset=${j}&sysparm_limit=1000" -o "${i}_out${j}.json"
look for non null values for each key ? ( for me YMMV )
grep -E "(\bip.address\b|\bsupport.group\b|owned_by\b|\bsys_class_name\b|\blocation\b|\bsys_class_name\b|\bdns_domain\b|\bsys_domain\b|\bfqdn\b|\bbusines_criticality\b|\bclass_name\b|\boperational_status\b|\bcreated_by\b|\bassignment_group\b|\bassigned_to\b|\bsvc_service_id\b)" Pretty_* -A 1
Working on filtering like ¬%20owned_by="" or something .. I have no idea hopfuly sometihng on github that uses this API with filtering so ill post or mesg me
- rmccurdy.com