Event Field Codes

[itgfcsys]

All

I am working on some automation and integration efforts and am trying to find a listing of available event and alarm field codes/variables. For example [$EventID], [$Event Subtype]. Is this information available, I would suspect theres an option to export or dump these and the custom fields, which appear to be resultant from custom variables, where ever these are set.

Thank you for any help in advance

[andy777 · Accepted solution]

Those are the variables you use in an Alarm (which are different than other classes of codes that are used for the API). The easiest way to find the relevant Alarm variable is to go to Alarms, go to Execute Command and select them from the drop down menu to populate the box. There is a limit of 50. I made a list of some of the most critical ones at the bottom of this page: GitHub - andywalden/mfe2snow: Open ServiceNow tickets from McAfee ESM​ for what I suspect is a similar purpose.

[itgfcsys]

Very similar effort, using evanios in place of home-brew server, as its a supported infrastructure piece.