When using the servicenow add-on, say we have it configured to pull table data from ServiceNow every 2 minutes but the api call to ServiceNow from splunk takes longer than that (for whatever reason) to retrieve the data - will the add-on startup another process after 2 minutes to retrieve data, or can only one connection (per table) ever be made by the add-on?
We encountered a situation where the add-on was taking a long time to pull the data and it looked like the add-on was firing up multiple connections for the same table instead of waiting for current connections to finish (or time out). Luckily we got a notice from ServiceNow support that there was an issue with the service account used by splunk in servicenow and that we were in danger of the "API_INT semaphores being exhausted" in our ServiceNow instance, so we locked out the account to avoid this.
Also, is it possible to remove the ORDERBY query param in the api query sent by splunk to servicenow? Adding additional WHERE clauses to queries slows things down, and I would think the main priority would be to get the data from servicenow into splunk as efficiently as possible and not worrying about what order it is in as it comes from ServiceNow (but maybe there is a reason for this).
Thanks.
