All Apps and Add-ons

Error while configuring Splunk Add-on for ServiceNow

rsingh_splunk
Splunk Employee
Splunk Employee

Hi Guys,

Getting an error while trying to configure the Splunk Add-on for ServiceNow.
If anyone could throw some light on it, that would be of great help.alt text

Thanks in advance..

0 Karma
1 Solution

rpille_splunk
Splunk Employee
Splunk Employee

Possibly. I have not tested this with a non-admin account, as you need certain admin capabilities to even reach the setup page.

Does your Splunk user or role have the admin_all_objects capability? Are you able to reproduce the error if you spin up a new instance, install the add-on there, and use an admin role account to try this configuration?

View solution in original post

rpille_splunk
Splunk Employee
Splunk Employee

Possibly. I have not tested this with a non-admin account, as you need certain admin capabilities to even reach the setup page.

Does your Splunk user or role have the admin_all_objects capability? Are you able to reproduce the error if you spin up a new instance, install the add-on there, and use an admin role account to try this configuration?

rsingh_splunk
Splunk Employee
Splunk Employee

Seems like, that indeed was the problem.
I installed the add-on on a separate instance where i have the admin access and I could get it working over there.
Thanks for the help though @rpille_splunk .

0 Karma

rpille_splunk
Splunk Employee
Splunk Employee

Hi rsingh, sorry about the unhelpful error message. We'll see what we can do to improve that.

I can reproduce when I try to save or update the account with an empty password field. Try retyping your credentials and making certain they are correct to see if that resolves the error.

0 Karma

rsingh_splunk
Splunk Employee
Splunk Employee

Hey Thanks for the advice @rpille_splunk but this doesn't seem to be the problem as I've cross-checked the credentials many times.

0 Karma

rpille_splunk
Splunk Employee
Splunk Employee

Hm, okay. I confirmed with my own account that the error does not appear with the correct ServiceNow URL, correct username, and correct password, and no proxy set. Can you tell me if you are using a proxy, either in this setup page or globally in splunk-launch.conf?

Also, what version of ServiceNow are you using at your organization?
Please also confirm your version of the Splunk platform, and whether you are configuring this on a single-instance, on a heavy forwarder, or on Splunk Cloud.

0 Karma

rsingh_splunk
Splunk Employee
Splunk Employee

No, we're not using any proxy and are running on Splunk Enterprise Version 6.4.1 and the ServiceNow version is Geneva.
After trying to recreate the error on a different Splunk instance, I believe I'm getting the error because of the Semi-Admin access I have on that instance where i'm trying to configure it.
Could this be the case @rpille_splunk ?

0 Karma

woodcock
Esteemed Legend

It will help if you type in the error text.

0 Karma

rpille_splunk
Splunk Employee
Splunk Employee

It is this:
Encountered the following error while trying to update: In handler 'localapps': Error while posting to url=/servicesNS/nobody/Splunk_TA_snow/service_now_setup/snow_account/snow_account

0 Karma

ehaddad_splunk
Splunk Employee
Splunk Employee

The error could be misleading and could be related to bad setup information. I would start by validating that:
1- ServiceNow URL has the right format - something like https://mycompany.service-now.com and make sure its accessbile
2- Make sure you can login using the same creds
3- if there is any proxy, make sure you set it up in the add-on.

0 Karma

rsingh_splunk
Splunk Employee
Splunk Employee

Thanks, checked those but no luck.

0 Karma

ehaddad_splunk
Splunk Employee
Splunk Employee

is this on windows? what version of splunk are you using ?

0 Karma

rsingh_splunk
Splunk Employee
Splunk Employee

Hi, It's running on a linux machine and the Splunk version is 6.4.1

0 Karma

ehaddad_splunk
Splunk Employee
Splunk Employee

Thanks. Can you paste any error from the internal logs?
Index=_internal error snow

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...