Why is Service now Add on in Splunk is not extracting all the fields?

[srisahitya_v]

Hello All,

I'm using Service now add-on for Splunk and installed on Heavy forwarder. Through setup page in add-on I have added few tables data into Splunk.

But the add-on not properly extracted the field values and few metrics tables also not visible in Splunk index.

add-on version 4.0.0, Splunk version 7.2.1.

can some one help me with what might causing this problem.

[desoto-chan]

I guess you did not use any tool to make the connection? We have an upcoming project that includes the integration of those two systems. But we'll be using a custom tool (it's called zigiops) so that everything will be handled and done in no time.

[sylim_splunk]

The events from SNOW appear to be very large and if you couldn't reduce the size of the events any more, you may want to check the length of raw events. Just in case the missing fields happens mostly from events larger than 10000 and which - those missing fields - appear more than 10k bytes into the events. Then try to tune maxchars under kv.

• Use len function to get length
  "your base search for SNOW data" | eval length = len(_raw)

• Tune maxchars
  In limits.conf
  [kv]
  maxchars = 10240 to be tuned according to raw event length if it happens to the events larger than 10240.

[KARANMALHOTRA]

I had a similar problem where the Service Now add-on was not extracting the fields when I was looking at the events in Search.

The reason I found was that a limit is applied on Field Extractions while searching. By default, after 10000 characters (if i remember the value correctly), Splunk will stop identifying new fields.

In case your issue is the same, you have 2 options:

1. Increase the limit from 10000 to something much larger (not recommended in most cases)
2. Update the inputs for tables that you have enabled in the Service Now add-on to Exclude certain fields that have long string data. e.g. Comments & Work Notes for Incidents.

I used the 2nd approach and was able to get the extraction to work properly.