hi
After recently upgrading to new version of ServiceNow app, we have found that the display value (dv_*) field have automatically been enabled. This makes each event/payload quite huge and makes them cumbersome to investigate. Some of the display_value fields are quite useful.
We could see the workaround provided per the docs to disable dv_* fields entirely: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Upgrade
So the question is
Can we selectively NOT index certain fields? (For example, we don't need fields like `dv_approval_history from change_request table`)
How to select the fields which are not required for indexing?
↧