Anyone else hitting the "Export to CSV" button in the GRC Findings module only to get a timeout or a partial file? My boss wants a simple, flat list of all open findings across all applications—just the basics like ID, title, owner, due date, and status—but the UI export consistently fails for our dataset (~5000 findings).
I'm used to wrangling data out of Prometheus and Loki, so I figured there must be a way to query the ServiceNow tables directly. I tried the `sys_report` API endpoint, but the formatting was messy. The approach that finally worked was using the Table API with a simple script.
Here's a basic Python script using the `pysnow` library. You'll need to adjust the `instance`, credentials, and the table name (likely `sn_grc_finding`).
```python
import pysnow
import csv
# Initialize client
instance = 'yourinstance'
user = 'your_user'
password = 'your_pass'
client = pysnow.Client(instance=instance, user=user, password=password)
# Create a resource for the findings table
finding_resource = client.resource(api_path='/table/sn_grc_finding')
# Query for open findings, adjust query as needed
query = pysnow.QueryBuilder()
query.field('state').equals('Open') # Or omit for all findings
response = finding_resource.get(query=query, stream=True)
findings = response.all()
# Write to CSV
if findings:
keys = findings[0].keys()
with open('findings_export.csv', 'w', newline='') as f:
dict_writer = csv.DictWriter(f, fieldnames=keys)
dict_writer.writeheader()
dict_writer.writerows(findings)
```
A couple of gotchas I ran into:
* The table name might vary. Check the table label in your instance.
* Column names are internal. You might need to map them to user-friendly names (e.g., `u_owner` -> `Owner`).
* Pagination is handled by `stream=True` in `pysnow`. If you're using raw REST, you'll need to handle `__next` links.
Has anyone found a more straightforward method, maybe using a scheduled Data Source in Performance Analytics? I'm curious if there's a built-in way that's more reliable than the UI export.
- away