Splunk Enterprise Security

Why is Service now Add on in Splunk is not extracting all the fields?


Hello All,

I'm using Service now add-on for Splunk and installed on Heavy forwarder. Through setup page in add-on I have added few tables data into Splunk.

But the add-on not properly extracted the field values and few metrics tables also not visible in Splunk index.

add-on version 4.0.0, Splunk version 7.2.1.

can some one help me with what might causing this problem.

Labels (1)
0 Karma


I guess you did not use any tool to make the connection? We have an upcoming project that includes the integration of those two systems. But we'll be using a custom tool (it's called zigiops) so that everything will be handled and done in no time.

0 Karma

Splunk Employee
Splunk Employee

The events from SNOW appear to be very large and if you couldn't reduce the size of the events any more, you may want to check the length of raw events. Just in case the missing fields happens mostly from events larger than 10000 and which - those missing fields - appear more than 10k bytes into the events. Then try to tune maxchars under kv.

  • Use len function to get length
    "your base search for SNOW data" | eval length = len(_raw)

  • Tune maxchars
    In limits.conf
    maxchars = 10240 to be tuned according to raw event length if it happens to the events larger than 10240.

0 Karma

Path Finder

I had a similar problem where the Service Now add-on was not extracting the fields when I was looking at the events in Search.

The reason I found was that a limit is applied on Field Extractions while searching. By default, after 10000 characters (if i remember the value correctly), Splunk will stop identifying new fields.

In case your issue is the same, you have 2 options:

  1. Increase the limit from 10000 to something much larger (not recommended in most cases)
  2. Update the inputs for tables that you have enabled in the Service Now add-on to Exclude certain fields that have long string data. e.g. Comments & Work Notes for Incidents.

I used the 2nd approach and was able to get the extraction to work properly.

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...