Splunk App for ServiceNow: Error - "Could not find all of the specified lookup fields in the lookup table"

[uhaba]

I'm getting this error after installing the servicenow TA and app and not sure why. I've pulled out the relevant snips targeting the error. I've also cat'ed the lookup to see if there's any odd characters in there and didn't find any.

Error message:

Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'snow:em_event' and lookup table 'severity_lookup'.

props.conf

[snow:em_event]
EXTRACT-snow_em_event_alert = alert="(?P[^\s"]*)"

For display_value = all, uncomment the following.
FIELDALIAS-severity_name = dv_severity AS severity_name

For display_value = all, comment the following.
LOOKUP-severity_name = severity_lookup severity AS severity OUTPUTNEW severity_$

transforms.conf

[severity_lookup]
filename = severity.csv

severity.csv

severity,severity_name
0,Clear
1,Critical
2,Major
3,Minor
4,Warning

cat output

[root@[host]lookups]# cat severity.csv
severity,severity_name
0,Clear
1,Critical
2,Major
3,Minor
4,Warning

[mreynov_splunk]

Your props look all mangled. Here is my copy:

[snow:em_event]
EXTRACT-snow_em_event_alert = alert="(?P<snow_em_event_alert>[^\s"]*)"

# For display_value = all, uncomment the following.
#FIELDALIAS-severity_name = dv_severity AS severity_name

# For display_value = all, comment the following.
LOOKUP-severity_name = severity_lookup severity AS severity OUTPUTNEW severity_name AS severity_name

I would suggest reinstalling the addon.

[splunk4now]

http://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Troubleshooting. Please configure lookup as per your SNOW instance for events or disable lookup. ,Add on does variety of lookup. The current lookup list might have to be modified for the values used in your SNOW system. I think the documentation clearly outlines this part. http://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Troubleshooting

[uhaba]

bump. Anyone suggestions?