All Apps and Add-ons

Why are fields are not extracting properly in ServiceNow add-on?

sylim_splunk
Splunk Employee
Splunk Employee

ServiceNow add-on events are not extracting some fields properly, of which length are more than 10,000 bytes.

Due to that problem my users are not getting recent updates on ServiceNow task and Indicents in their dashboards.
The data we have concerns now was ingested several month ago - there are many more data that don't have fields not extracted though.
A search indeed shows the fields and values in _raw data so indexing is not the cause here.

Tags (1)
0 Karma
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

Here's a suggestion : https://answers.splunk.com/answers/770012/service-now-add-on-in-splunk-is-not-extracting-all.html - this would work if you could reduce the size of raw events down to less than 10240.

If this doesn't help fix the situation you can try the below which actually fix the field extraction issue here.
in limits.conf

[kv]
maxchars = 50000 ( by default 10240)

The 50k has been picked up by going through some raw data that have the field extraction issue, calculated based on where the fields in question appear into the events.
The maxchars is the limit that Splunk stop the field extraction process. TRUNCATE=10000 is not an issue here as long as you have "SHOULD_LINEMERGE=true" or the indexed raw data is longer than "TRUNCATE" value for the source/sourcetype.

View solution in original post

sylim_splunk
Splunk Employee
Splunk Employee

Here's a suggestion : https://answers.splunk.com/answers/770012/service-now-add-on-in-splunk-is-not-extracting-all.html - this would work if you could reduce the size of raw events down to less than 10240.

If this doesn't help fix the situation you can try the below which actually fix the field extraction issue here.
in limits.conf

[kv]
maxchars = 50000 ( by default 10240)

The 50k has been picked up by going through some raw data that have the field extraction issue, calculated based on where the fields in question appear into the events.
The maxchars is the limit that Splunk stop the field extraction process. TRUNCATE=10000 is not an issue here as long as you have "SHOULD_LINEMERGE=true" or the indexed raw data is longer than "TRUNCATE" value for the source/sourcetype.

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...