Insufficient permission for Splunk service now addon

[ips_mandar]

For eventtype="snow_ta_log_error" I am getting below error-

 ERROR pid=89870 tid=MainThread file=rest.py:splunkd_request:53 | Failed to send rest request=https://127.0.0.1:8089/servicesNS/nobody/Splunk_TA_snow/storage/passwords/https%5C%3A%252F%252Fxyz.service-now.com%3Adummy%3A, errcode=403, reason=Insufficient permission.

ERROR pid=89870 tid=MainThread file=snow_ticket.py:_get_service_now_account:160 | Failed to get clear credentials for https://xyz.service-now.com

How to troubleshoot this permission error.
Thanks,

[koshyk]

ah.ok. You didn't mention the credential changes in your main post !
So definitely it is related to credentials. To debug it

1. Ensure your credentials are same in ServiceNow. Speak to your SNOW admin to put the password again in your integration user

2.Using CURL, try querying ServiceNow and see if you can retrieve data with creds.

snowInstance=myservicenowInstance
tabName=incident
pass=mypassword
userid=myuser

curl --user ${userid}:${pass} --header "Accept: application/json" https://${snowInstance}/api/now/table/${tabName} | grep }| python -mson.tool >/tmp/${tabName}.json

1. ONLY if above works, you need to delete the entries in "local/passwords.conf" in your installation and put the creds again. Restart Splunk

[koshyk]

which TA version you using? Also which ServiceNow version you are integrating to?

[ips_mandar]

I am using Splunk_TA_snow version 3.1.0 and not sure about ServiceNow version how can I know this?

[koshyk]

you may need to ask your ServiceNow Admin or sometimes, it will shown up on the header page (or source code of ServiceNow). There are few versions out there like Kingston, Jakarta etc.

There is dependency on Splunk Enterprise Version => Addon Version => ServiceNow version

[ips_mandar]

but this error started coming from few days back might after credentials was changed so it will probably not an issue of version