Hello,
I set up the app and add-on for ServiceNow but cannot have the right name for the field cmdb_ci, it'es always something like : f97dcb156fdd1140436a5afc5d3ee4cf
I activated all the search for the add-on but the result is the same
Any help would be appreciated.
This resolved my issue.
We updated the TA_snow in 2.9
In this version the option sys_display_value=true is available in the service_now.conf
By adding this Splunk index new fields with "dv_" in front of them.
Example : dv_cmdb_ci
Instead of the reference (f97dcb156fdd1140436a5afc5d3ee4cf) we have the real value of the field
This resolved my issue.
We updated the TA_snow in 2.9
In this version the option sys_display_value=true is available in the service_now.conf
By adding this Splunk index new fields with "dv_" in front of them.
Example : dv_cmdb_ci
Instead of the reference (f97dcb156fdd1140436a5afc5d3ee4cf) we have the real value of the field
I had been wondering what the "dv_" in front of all those fields names has meant for so long and this just answered that question. Thank you.
What you are seeing is a sysid within the Service Now tables. You will need to create a lookup from that sysid to the actual field value you are trying to display/get. Most of these lookups are within the sys_choices table within Service Now which is an option to index as part of the Add-On for Service Now. There is also a savedsearch that takes the sys_choices table and converts it into an inputlookup csv file that you will need to enable as well.
You may need to work with your Service Now administrators to identify any custom fields that have been created and referenced into custom tables as well.
You are then able to create an [|inputlookup ] search once you have the correct Service Now table lookup created to find the value you are looking for.
The sys_choices table is already indexed but the lookup file sys_choice_list.csv is empty
i guess this is from the Service Now configuration, i will have a look on this
Thank for the answer