All Apps and Add-ons

Getting ServerNotFoundError when connecting to ServiceNow via proxy

splunk4chrys
New Member

Hi,
I deployed Splunk Add-on for ServiceNow (on Splunk 6.1.3 version) and when I try to configure the app to connect to ServiceNow URL, I get following error:
"ServerNotFoundError: Unable to find the server at https://mydomain.service-now.com"

Any idea how I can fix this issue.

Thanks

0 Karma

nyfaisal
Path Finder

we are having the same issue behind proxy. Every time I use the add-on set up page, it overwrites the local/service_now.conf file with empty entries, and times out. very frustrating, as the app does not attempt to authenticate to proxy (no traffic to proxy using tcpdump).

[splunk@~]$ more /opt/apps/splunk/etc/apps/Splunk_TA_snow/local/service_now.conf
[snow_account]
password =
url =
username =
release = Automatic

[snow_default]
collection_interval = 600
loglevel = ERROR

[snow_proxy]
proxy_enabled = 1
proxy_port = 9090
proxy_url =
proxy_password =
proxy_username =

0 Karma

splunk4chrys
New Member

Hi,
Here is my service_now.conf text (removed the actual names and ports)

[snow_account]
password = <encrypted>
url = https://myservername.service-now.com
username = <encrypted>
release = Fuji

[snow_default]
collection_interval = 600
loglevel = DEBUG

[snow_proxy]
proxy_enabled = 1
proxy_port = <proxy port>
proxy_url = <proxy server DNS name>
proxy_password =
proxy_username =

And this is what I get in the ta_snow_setup.log file:
2015-05-11 15:48:52,858 INFO 5320 - Detect ServiceNow release and verify credentials
2015-05-11 15:48:52,867 INFO 5320 - decrypting
2015-05-11 15:48:52,878 ERROR 5320 - Failed to validate ServiceNow account or detect release info. Please verify credentials, urls for ServiceNow and proxy, and try again. Reason=Traceback (most recent call last):
File "C:\SPLUNK\etc\apps\Splunk_TA_snow\bin\snow_setup.py", line 227, in detect_release
conf_mgr, config, self.appName, True)
File "C:\SPLUNK\etc\apps\Splunk_TA_snow\bin\snow_config.py", line 109, in fix_snow_release
fixed_release = SnowConfig.get_snow_release(defaults)
File "C:\SPLUNK\etc\apps\Splunk_TA_snow\bin\snow_config.py", line 165, in get_snow_release
raise Exception(msg)
Exception: Failed to get ServiceNow release information, reason=Traceback (most recent call last):
File "C:\SPLUNK\etc\apps\Splunk_TA_snow\bin\snow_config.py", line 160, in get_snow_release
resp, content = http.request(url)
File "C:\SPLUNK\etc\apps\Splunk_TA_snow\bin\httplib2__init
.py", line 1593, in request
(response, content) = self._request(conn, authority, uri, request_uri, method, body, headers, redirections, cachekey)
File "C:\SPLUNK\etc\apps\Splunk_TA_snow\bin\httplib2__init
.py", line 1335, in _request
(response, content) = self._conn_request(conn, request_uri, method, body, headers)
File "C:\SPLUNK\etc\apps\Splunk_TA_snow\bin\httplib2__init
_.py", line 1263, in _conn_request
raise ServerNotFoundError("Unable to find the server at %s" % conn.host)
ServerNotFoundError: Unable to find the server at <masked_server_name>.service-now

I installed Splunk and the add-on on another test server and got same error. This test server has another application that connects successfully to ServiceNow using the same proxy server.

Thanks

0 Karma

sbrice36
Explorer

Any update on this? I am getting the same error setting up my Splunk connection to SNOW. We do not have a Proxy server in the mix.

Encountered the following error while trying to update: In handler 'localapps': Error while posting to url=/servicesNS/nobody/Splunk_TA_snow/service_now_setup/snow_proxy/snow_proxy

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

any time you're getting an error trying to post to a Splunk URL, it's probably about Splunk permissions or timing... if it's Windows, it's probably about timeouts.

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

We've discovered a proxy issue in this Add-on through support tickets that we filed -- thanks, those of you who file support tickets for supported code! Now that we understand the issue, we'll post a fix to this Add-on shortly.

0 Karma

hitesh_kanchan
Explorer

@joates We are using the below version for ServiceNow.
Splunk AddOn "Splunk_TA_snow 2.6.0"
Splunk App "snow_event_management 3.0"

Has the proxy issue been fixed in these versions as I face connection timeouts sometimes.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

So, if you are connecting to the internet via a proxy, did you configure your company's proxy details as documented?

[snow_proxy]

proxy_enabled Indicates whether connection to ServiceNow occurs through a proxy. Default is false.
proxy_url URL or IP address for the proxy connection. Invoked only if proxy_enabled is set to true.
proxy_port Port for the proxy connection. Invoked only if proxy_enabled is set to true.
proxy_username Username for the proxy connection. Invoked only if proxy_enabled is set to true.
proxy_password Password for the proxy connection. Invoked only if proxy_enabled is set to true.

0 Karma

splunk4chrys
New Member

And this is what I get in the ta_snow_setup.log file:
Failed to validate ServiceNow account or detect release info. Please verify credentials, urls for ServiceNow and proxy, and try again. Reason=Traceback (most recent call last):
File "C:SPLUNKetcappsSplunk_TA_snowbinsnow_setup.py", line 227, in _detect_release
conf_mgr, config, self.appName, True)
File "C:SPLUNKetcappsSplunk_TA_snowbinsnow_config.py", line 109, in fix_snow_release
fixed_release = SnowConfig.get_snow_release(defaults)
File "C:SPLUNKetcappsSplunk_TA_snowbinsnow_config.py", line 165, in get_snow_release
raise Exception(msg)
Exception: Failed to get ServiceNow release information, reason=Traceback (most recent call last):
File "C:SPLUNKetcappsSplunk_TA_snowbinsnow_config.py", line 160, in get_snow_release
resp, content = http.request(url)
File "C:SPLUNKetcappsSplunk_TA_snowbinhttplib2init.py", line 1593, in request
(response, content) = self._request(conn, authority, uri, request_uri, method, body, headers, redirections, cachekey)
File "C:SPLUNKetcappsSplunk_TA_snowbinhttplib2init.py", line 1335, in _request
(response, content) = self._conn_request(conn, request_uri, method, body, headers)
File "C:SPLUNKetcappsSplunk_TA_snowbinhttplib2init.py", line 1263, in _conn_request
raise ServerNotFoundError("Unable to find the server at %s" % conn.host)
ServerNotFoundError: Unable to find the server at <masked_server_name>.service-now

0 Karma

splunk4chrys
New Member

wireshark capture gave following error:
{"status": "ERROR", "msg": "Encountered the following error while trying to update: \n In handler 'localapps': Error while posting to url=/servicesNS/nobody/Splunk_TA_snow/service_now_setup/snow_proxy/snow_proxy"}

0 Karma

splunk4chrys
New Member

Hi,
Here is my service_now.conf text (removed the actual names and ports)

[snow_account]
password = <encrypted>
url = https://myservername.service-now.com
username = <encrypted>
release = Fuji

[snow_default]
collection_interval = 600
loglevel = DEBUG

[snow_proxy]
proxy_enabled = 1
proxy_port = <proxy port>
proxy_url = <proxy server DNS name>
proxy_password =
proxy_username =

Thanks

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

mydomain.service-now.com is probably not an existing, valid name. Did you follow the installation instructions here to properly configure the Add-on?

0 Karma

splunk4chrys
New Member

Hi,
I replaced my actual server/domain name with "mydomain" string to hide the company name. The ServiceNow version I am trying to connect to is Fuji. The Add-On version is 2.6.0.

I get this error while performing the steps under "Set up the add-on using Splunk Web".

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

It sounds like your configured service now server is just not resolved. Can you ping the server from a command prompt? Or just do an nslookup <yourdomain>.service-now.com and see if your Splunk machine has a valid DNS server configured and can resolve the name?

0 Karma

splunk4chrys
New Member

I cannot resolve the name from command line but when i manually access the servicenow site, it works fine. Proxy server does the name resolution for this external site.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...