All Apps and Add-ons

Service Now: How to get the correct names of cmdb_ci ?

ThomasLeroy
Explorer

Hello,

I set up the app and add-on for ServiceNow but cannot have the right name for the field cmdb_ci, it'es always something like : f97dcb156fdd1140436a5afc5d3ee4cf

I activated all the search for the add-on but the result is the same

Any help would be appreciated.

0 Karma
1 Solution

ThomasLeroy
Explorer

This resolved my issue.

We updated the TA_snow in 2.9
In this version the option sys_display_value=true is available in the service_now.conf

By adding this Splunk index new fields with "dv_" in front of them.

Example : dv_cmdb_ci
Instead of the reference (f97dcb156fdd1140436a5afc5d3ee4cf) we have the real value of the field

View solution in original post

ThomasLeroy
Explorer

This resolved my issue.

We updated the TA_snow in 2.9
In this version the option sys_display_value=true is available in the service_now.conf

By adding this Splunk index new fields with "dv_" in front of them.

Example : dv_cmdb_ci
Instead of the reference (f97dcb156fdd1140436a5afc5d3ee4cf) we have the real value of the field

michaelsplunk1
Path Finder

I had been wondering what the "dv_" in front of all those fields names has meant for so long and this just answered that question. Thank you.

0 Karma

jwiedow
Communicator

What you are seeing is a sysid within the Service Now tables. You will need to create a lookup from that sysid to the actual field value you are trying to display/get. Most of these lookups are within the sys_choices table within Service Now which is an option to index as part of the Add-On for Service Now. There is also a savedsearch that takes the sys_choices table and converts it into an inputlookup csv file that you will need to enable as well.

You may need to work with your Service Now administrators to identify any custom fields that have been created and referenced into custom tables as well.

You are then able to create an [|inputlookup ] search once you have the correct Service Now table lookup created to find the value you are looking for.

0 Karma

ThomasLeroy
Explorer

The sys_choices table is already indexed but the lookup file sys_choice_list.csv is empty
i guess this is from the Service Now configuration, i will have a look on this

Thank for the answer

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...