- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
3 weeks ago - last edited 3 weeks ago
Hello,
Editing as I have gained more information since initially posting
Please note that I cannot use any scripting, and everything needs to be done within the www.instance.service-now.com/now/sow/enrich-automation/x page.
I am trying to figure out how to extract specific data from a serialized json string within the additional info field. The only thing I've been able to do so far is use (.....)*. to extract speficied text by positioning, but this is extremely unreliable. My string looks a bit like this
{"json_rootfield1":"{\"custom_field1\":\"Value_1 \\n\",\"custom_field2\":\"Value_2 \\n\",\"custom_field3\":\"Value3\",\"custom_field4\":\"Value4 \\n\",\"custom_field5\":\"Value5\",\"custom_field6\":\"Value6\",\"custom_field7\":\"Value7\",\"custom_field8\":\"Value8\"}","json_rootfield2":true,"json_rootfield3":"1234"}
How would I, for example, extract the rootvalue2 from this string? Is there any documentation anywhere that is more in depth than the SNow page because that one is extremely barebones. The goal is to do this without the use of scripting.
I have successfully extracted using regex101. However, ServiceNow uses it's own regex backend with slight differences. even using \d{4} fails to extract a 4 digit number from a string such as this:
<99>TEXT: 'TEXT_9999' INFO: INFORMATION
I've also uploaded two sample regex which should theoretically work, but do not.
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
3 weeks ago - last edited 3 weeks ago
I've found the nomenclature for this to function properly, at least for the following example. Given the text below
<99>TEXT: 'TEXT_9999' INFO: INFORMATION
a regex of .*([0-9]{4}).* will output the proper information.
This seems to be due to two reasons. The search does not look through the entire input by default, hence the need for .* encapsulating the query, which returns a match for the entire input. We then require the regex to be within parenthesis to create the group, outputting the desired data. Here is a screen capture explaining the results
I will mark this as resolved for future reference. Thank you everyone
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
3 weeks ago
Hi @Ngauthier
If the JSON file works across other programs, basic JavaScript can be used as described in the document below.
{
"json_rootfield1": {
"custom_field1": "Value_1 \n",
"custom_field2": "Value_2 \n",
"custom_field3": "Value3",
"custom_field4": "Value4 \n",
"custom_field5": "Value5",
"custom_field6": "Value6",
"custom_field7": "Value7",
"custom_field8": "Value8"
},
"json_rootfield2": "rootvalue2",
"json_rootfield3": "rootvalue3"
}
Regards.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
3 weeks ago
Hi @mugi-san
Unfortunately, the goal is to avoid scripting altogether and use solely the Alert Enrichment page. Since posting, I've looked at the following page
https://www.servicenow.com/community/developer-articles/common-regular-expressions-and-cheat-sheet/t...
I've successfully used the info on here to extract from my text using 3rd party websites such as regex101, but as I understand it, ServiceNow uses a different regex backend.
Even this simple sample does not find a match
Sample value:
<99>TEXT: 'TEXT_9999' INFO: INFORMATION
Regex:
\d{4}
This leads me to believe that the Alert Enrichment via Regex is not functionning properly, or the backend is unique and I would require the help of a ServiceNow support agent for additional help.
Any link to additional documentation would be greatly appreciated
P.S.
Note that the above example is not a json, but a simple string. I attempted extraction via regex using a simpler format to diagnose
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
3 weeks ago - last edited 3 weeks ago
Hello @Ngauthier .
If you would like to change the topic from your initial inquiry, creating a new question will help minimize confusion.
According to the official documentation for the feature you provided, it states that compatibility with PCRE (Perl Compatible Regular Expressions) is guaranteed.
https://www.servicenow.com/docs/csh?topicname=enrich-alert-sow-itom.html&version=latest
However, a technical characteristic of the PCRE engine is that its behavior in regular expressions can vary depending on how ServiceNow compiled it into their environment. Furthermore, there is no verified information regarding the extent of ServiceNow's regex support, such as any limitations implemented for vulnerability mitigation.
As you mentioned, if basic regular expressions are not functioning, it will be necessary to open a support case with ServiceNow and wait for a fix.
Regards.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
3 weeks ago
Hi @Ngauthier ,
it seems double encoded json ,you can use JSON.parse twice :
var obj = JSON.parse(additional_info);
var inner = JSON.parse(obj.json_rootfield1);
gs.info(obj.json_rootfield2);
If you found my solution helpful, please mark it as Helpful or Accepted Solution...!
thanks,
tejas
Email: adhalraotejas1018@gmail.com
LinkedIn: https://www.linkedin.com/in/tejas1018
