ServiceNow Search CI help

I’m having some trouble with searching for a CI using the rapid7/servicenow:4.1.0 plugin and “Search CI” Action.
Using cURL I can do a query fqdnLIKEserver01&name=server01 to look for a server but not the vmware instances of it, but when I do this in InsightConnect it ignores the second part. I’ve tried

  • fqdnLIKEserver01^ANDname=server01
  • fqdnLIKEserver01ANDname=server01
  • fqdnLIKEserver01,name=server01

and they either give me the same thing or nothing at all. what am I doing wrong?

Have you tried something like fqdnLIKEserver01^name=server01 ? (I removed the AND there)

I know some of their operators can be funky or inconsistent. Like I think they use ^OR for “or” but just ^ for “and.”

1 Like

You are Awesome! Exactly what I was looking for!

1 Like

Yay, glad it worked!

I had to do some digging for it, but I finally found a guide for their operators:

My googlefu is failing me :frowning: thank you, I have bookmarked that site

1 Like

I see now that the plugin is populating the sysparm_query parameter and that is what was throwing me off.
Would it be possible to get some of the other parameters also like sysparm_fields, sysparm_limit, or sysparm_offset?
I’ve noticed the memory usage of my container is growing pretty fast and since I only need a field or two from my checks I’d think limiting the data returned to those would save me from having to constantly bounce the container and also speed up Jobs.