Within the inputs.conf file under the local directory of the Splunk Addon for ServiceNow, I know its possible to define CMDB tables that you want to pull into splunk. I also know that by defining the an input with the context "filter_data = ", you can constrain the data being pulled according certain table elements/values. I had previously set up my inputs.conf as such: [snow://sysevent] exclude = description duration = 60 since_when = 2000-01-01 00:00:00 filter_data= name=login* In an attempt to pull all events with the string "login" within the name field of the CMDB table "sysevent". Now this didn't work, but my question is if its possible to declare a wildcard catch all within the "filter_data" parameter, so that I can pull all the events I want but only those related to logins. If not, is it possible to define multiple filter_data parameters so that I can define each event that I want by name? ... View more

I've recently installed the Splunk Add-on for ServiceNow(SNOW) on my instance and have seen success across all the default settings. The integration with our SNOW instance went off without a hitch, and the Configuration Management Database (CMDB) information is flowing through the sourcetypes, eventtypes and saved searches as intended. However, we now have use cases for the database tables in SNOW that were not included in the default inputs that came out of the box with the Add-on. From what I understand of the documentation, if I wanted to pull the database table for "cmdb_ci_win_server" into Splunk, I should just define the data input under Settings>Data Inputs>Splunk Addon for ServiceNow. However, all my attempts so far have failed. New input definitions I've created within the WebUI don't populate into the local/inputs.conf file at all. And even when I define the new data input within local/inputs.conf, new sourcetypes or eventtypes are not created so I can't tell if the data is being pulled down or not. Does anyone have any experience with introducing new database table inputs into Splunk for the Splunk Add-on for ServiceNow? ... View more