query_cis_raw
Execute raw ServiceNow encoded queries on CMDB tables to retrieve configuration items with pagination and field selection.
Instructions
Execute a raw encoded query against any CMDB table.
For advanced users who know ServiceNow encoded query syntax. The query is passed directly to the Table API's sysparm_query parameter without modification.
Note: Server-side script expressions (javascript:, gs.*, eval) are blocked for security. Use field-based operators only.
Examples of encoded queries: "nameSTARTSWITHweb^operational_status=1" — operational CIs starting with "web" "sys_class_name=cmdb_ci_linux_server^ip_addressISNOTEMPTY" — Linux servers with IPs "sys_updated_onRELATIVEGT@dayofweek@ago@90" — CIs updated in the last 90 days "assigned_to.nameLIKESmith^ORmanaged_by.nameLIKESmith" — CIs assigned to or managed by someone named Smith "install_status=1^operational_status=1^sys_class_nameINcmdb_ci_linux_server,cmdb_ci_win_server" — installed and operational servers "sys_updated_on<2025-01-01" — CIs not updated since a specific date
Args: table: ServiceNow table name (e.g. cmdb_ci, cmdb_ci_server, cmdb_ci_win_server). encoded_query: Raw ServiceNow encoded query string. fields: Specific fields to return. Defaults to sys_id, name, sys_class_name, operational_status, ip_address, location, sys_updated_on. limit: Maximum number of results to return (1-1000, default 25). offset: Pagination offset for retrieving subsequent pages. display_value: Controls how reference fields (location, company, assigned_to, etc.) are returned. "" (default) returns raw sys_id values. "true" returns human-readable display values (e.g. "New York" instead of a sys_id). "all" returns both as {"value": sys_id, "display_value": "New York"}. Use "true" when presenting data to users; use "all" when you need both the sys_id (for API calls) and the display name.
Returns: JSON object with "count" (results on this page), "records" (list of CI dicts), "total_count", "has_more", "next_offset", and "suggested_next". When display_value="all", each reference field in a record is returned as {"value": sys_id, "display_value": label} instead of a plain sys_id string.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| table | Yes | ||
| encoded_query | Yes | ||
| fields | No | ||
| limit | No | ||
| offset | No | ||
| display_value | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |