Ahhhh.....I think I see where the trouble is. I believe it is just the terminology.
So, "Node" in ServiceNow Event Management is what we(Evanios) call the monitored object. Node is kinda misleading.......In our stuff we call it the "ObjectName". But yes, this value would be the primary value/name of the event information coming from the monitored source tool.
For example, if it was a "Host Unavailable" event coming from SCOM tool, you would want the Node field value to represent the hostname/servername.
or if it was a "Router Down" event coming from Solarwinds tool, you would want the Node field value to represent the router/device name.
or if it was a " Oracle Database down" event coming from an Oracle application log, you would want the Node field value to represent the Oracle database name.
In our Evanios process, we call this event Normalization. Sometimes this event data can be anywhere within the monitored tools event stream. And it would need to be mapped or Normalized to have some Common Event Format structure in the Event Management solution. In ServiceNow Event Management, the Node field would map (Normalize) against a particular monitored tools event stream depending on what type of event it is.
I hope I didn't confuse you more. But I hope that helped a bit.
