topic Re: Error connecting to /servicesNS/nobody/Splunk_TA_snow/apps/local/Splunk_TA_snow/setup: ('The read operation timed out',) in All Apps and Add-ons

Why the error after installing Splunk add-on for ServiceNow in local Splunk Enterprise?

wangzhaoyu — Fri, 25 Mar 2022 21:02:20 GMT

Hello,

I've installed Splunk Addon for ServiceNow in my local Splunk Enterprise. In the setup page, enter required information, after clicking 'save', I got error message : Encountered the following error while trying to update: Splunkd daemon is not responding: (u"Error connecting to /servicesNS/nobody/Splunk_TA_snow/apps/local/Splunk_TA_snow/setup: ('The read operation timed out',)",)

How can I fix this issue? Thanks!

Re: Error connecting to /servicesNS/nobody/Splunk_TA_snow/apps/local/Splunk_TA_snow/setup: ('The read operation timed out',)

p_gurav — Wed, 02 Jan 2019 08:28:59 GMT

Is credentials you are using correct? Try setting up the add-on using service_now.conf instead of using Splunk Web

Re: Error connecting to /servicesNS/nobody/Splunk_TA_snow/apps/local/Splunk_TA_snow/setup: ('The read operation timed out',)

wangzhaoyu — Tue, 29 Sep 2020 22:38:17 GMT

yes, the credentials is correct.
I've tried modified service_now.conf manually, but the username and password always be rewritten as "encrypted" in local/service_now.conf. Is that correct?

By the way, where can I set the index and sourcetype in this Add-on?

Re: Error connecting to /servicesNS/nobody/Splunk_TA_snow/apps/local/Splunk_TA_snow/setup: ('The read operation timed out',)

p_gurav — Tue, 29 Sep 2020 22:33:23 GMT

Yes the credentials get encrypted once you restart service.

Also you can create inputs.conf to specify index and sourcetype, check below link:
https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Configureinputs

Can you check in _internal index, eventtype=snow_setup_error for any configuration errors?

Re: Error connecting to /servicesNS/nobody/Splunk_TA_snow/apps/local/Splunk_TA_snow/setup: ('The read operation timed out',)

wangzhaoyu — Tue, 29 Sep 2020 22:41:32 GMT

thank you so much. The Splunk_TA_snow works in my machine 🙂

but there is another question, I would like to specify the "display_value" for each ticket type.

I set "display_value = all" in service_now.conf, specify fields in inputs.conf like below, but still get all fields of incident_sla. how can I do that? thanks!
[snow://incident_sla]
display_value = inc_closed_at,inc_state,inc_number,inc_cmdb_ci,inc_priority,inc_category,inc_u_region

Re: Error connecting to /servicesNS/nobody/Splunk_TA_snow/apps/local/Splunk_TA_snow/setup: ('The read operation timed out',)

p_gurav — Fri, 11 Jan 2019 09:48:58 GMT

In version 3.0.0, the value of display_value is changed to all by default in Splunk Add-on for ServiceNow.
To revert to the previous behavior of collecting the display values using lookups and not directly from the API
Refer:
https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Upgrade

Re: Error connecting to /servicesNS/nobody/Splunk_TA_snow/apps/local/Splunk_TA_snow/setup: ('The read operation timed ou

dr5mn — Thu, 24 Mar 2022 20:07:00 GMT

Getting the same error. Saw another thread about the same issue, but posting my error here as well:

Getting the same when trying to change or update a local event log collection.

I started out by setting up local logging. I selected all possible windows events - perhaps this was a bit too eager as it zapped up my entire free quota for the day.

I then tried to remove some event types, but have been getting that error ever since.

Any ideas on how to fix this?