For eventtype="snow_ta_log_error"
I am getting below error-
ERROR pid=89870 tid=MainThread file=rest.py:splunkd_request:53 | Failed to send rest request=https://127.0.0.1:8089/servicesNS/nobody/Splunk_TA_snow/storage/passwords/https%5C%3A%252F%252Fxyz.service-now.com%3Adummy%3A, errcode=403, reason=Insufficient permission.
ERROR pid=89870 tid=MainThread file=snow_ticket.py:_get_service_now_account:160 | Failed to get clear credentials for https://xyz.service-now.com
How to troubleshoot this permission error.
Thanks,
ah.ok. You didn't mention the credential changes in your main post !
So definitely it is related to credentials. To debug it
2.Using CURL, try querying ServiceNow and see if you can retrieve data with creds.
snowInstance=myservicenowInstance
tabName=incident
pass=mypassword
userid=myuser
curl --user ${userid}:${pass} --header "Accept: application/json" https://${snowInstance}/api/now/table/${tabName} | grep }| python -mson.tool >/tmp/${tabName}.json
which TA version you using? Also which ServiceNow version you are integrating to?
I am using Splunk_TA_snow version 3.1.0 and not sure about ServiceNow version how can I know this?
you may need to ask your ServiceNow Admin or sometimes, it will shown up on the header page (or source code of ServiceNow). There are few versions out there like Kingston, Jakarta etc.
There is dependency on Splunk Enterprise Version => Addon Version => ServiceNow version
but this error started coming from few days back might after credentials was changed so it will probably not an issue of version