Splunk App & Add on for Servicenow

[rashidzaman]

I get an authentication error while configuring the App - " Could not authenticate to ServiceNow. Please check your credentials and try again."

Do we also need the Splunk Integration App installed on the Servicenow Side?
Are the Apps and Add ons compatible with the Madrid version of ServiceNow

[koshyk]

• Nothing is required to be installed on ServiceNow side, but just an API account enabled in ServiceNow . (eg . splunk_access_account)
• then test this account from your remote server using CURL . (replace the values accordingly) curl -k username:password http://{xyzcompany}.service-now.com/table/{tableName}/{sys_id}
• Check the response and ensure your API account works and response is fetched.
• Then configure inputs.conf in your ServiceNow addon (or separate app of your own) in your HeavyForwarder or Collection Splunk system and pull a table (eg incident table)

[pruthvikrishnap]

HI Rashid,

Regarding error, try removing your proxy from splunk-launch.conf and setting it in the add-on's (note: add-on, not the app) setup screen instead. There is an Enable Proxy box that you can check and fill out your proxy settings there.
Docs for setting it up: http://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Setuptheadd-on

add on is required for getting service now data to splunk
Latest version of TA should support the latest version of service now.