How to identify and validate CIs created via Discovery?

[Nia McCash]

We are implementing Discovery for the first time and were quite surprised (and impressed, and overwhelmed) by the amount of information that Discovery was able to pull in. 

For example: Running a quick discovery on 1 windows server alone created 68 CIs in 15 different classes.

Breaking down the problem:

1. How do you identify the CIs that were created via that particular scan?  The discovery status shows only the main device. Filtering the cmdb_ci list by created date is not helpful if you are discovering more than one device at a time on a given day:
   
   
   The ability to identify the CIs created via a particular scan is also important in the case we want to delete all the CIs related to this scan to attempt a fresh scan - since we are just starting out with Discovery and performing a lot of different tests.
   
   
2. Once you can identify a list of CIs that were created via a particular scan/a list of CIs associated to that particular device, how do you get a list of all the field values that were populated via Discovery for each CI? 
   
   Is there a more efficient way than going to each CI type, viewing or exporting a list of CIs created for that class including the fields specific to that class?
   
   If 15 different CI classes were created, that's 15 different lists to manually check -- and that's just for 1 windows server scan alone.  This number increases significantly the more types of devices are scanned. How have other organizations tackled this challenge?
   
   

[Ashutosh Munot1]

HI,

What discovery scans and what not is well documented on docs.

https://docs.servicenow.com/bundle/orlando-it-operations-management/page/product/discovery/concept/c_DataCollectedByDiscovery.html

Next when you delete the CI depending upon cascade deletion rules most of the related items are deleted. Now that is true that we dont have proper view of how many CIs are created for one Windows server. The only way to see that is to go to few tables in service now.

Thanks,
Ashutosh

[Nia McCash]

Thanks Ashutosh. I've found that deleting the main CI does not cascade delete everything cleanly 100% of the time. Will have to try this again to confirm though.

[Rahul Priyadars]

what is discovered by scan you can fetch from docs of service now per class.

How do you identify the CIs that were created via that particular scan?  The discovery status shows only the main device. Filtering the cmdb_ci list by created date is not helpful if you are discovering more than one device at a time on a given day:---> You can create a filter on Where

Created by=Discovery User and Created is on a given date range. It will give discoverd CI on that given day scan. Then you can do grouping by CLass , it will give you records discoverd/Class on that given day scan.

sample url is like

https://your.service-now.com/cmdb_ci_list.do?sysparm_query=sys_created_bySTARTSWITHyouruser.mid.discovery%5Esys_created_on%3Ejavascript:gs.dateGenerate(%272020-09-17%27%2C%2723:59:59%27)%5EGROUPBYsys_class_name&sysparm_first_row=1&sysparm_view=

Created>17/09/2020 is used as date .

Regards

RP

[Nia McCash]

Thanks Rahul. This is the method I've been using so far though not sure how well this works if we run a scheduled discovery of 4 servers and only want to identify the CIs related to 1 of those servers in order to delete them.

[User367757]

Nia I'm interested to know why you need to delete everything and "re-scan"?

When I'm developing a new Pattern / Probe / feature for Discovery, I generally just keep an eye on a list view of configuration items where created on is (relative) < 10 mins or something like that.

If you're really just running rapid cycle POC testing and not wishing to actually build & improve your CMDB, I would recommend using developer instances that you can easily release and refresh.