All Apps and Add-ons

Issues with the Splunk ServiceNow add-on- Not creating incidents?

Path Finder

Hi everyone,


I am experiencing some issues with the ServiceNow add-on not creating incidents in ServiceNow. I was able to successfully add the ServiceNow account in Splunk and confirmed that the correct permissions have been granted to the account in ServiceNow.


When I try to create an incident for an episode in Splunk ITSI I receive the error:

"Unable to run the action snow_incident. Make sure the action is configured correctly and has all required fields. See the Activity tab of the episode for more information."


I checked the Activity log and found the following errors:

"Action="snow_incident" failed with the following error: None search failed for actionId=search..."

"Search command "snowincidentalert" failed to return an incident ID or URL. Check the add-on configuration and input parameters."


I also ran the following search as per the Splunk documentation:



And I see the error:

"ERROR pid=1 tid=MainThread | Failed to connect to, error=Traceback (most recent call last):..."


I'm not sure why the URL is listed twice in the error. I am able to connect and login to the URL with the account used in Splunk.


Has anyone else run into an issue like this before?



Labels (2)
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...