Splunk_TA_Snow, was working and now throwing error "Failed to validate ServiceNow account or detect release info. Please verify credentials, urls for ServiceNow and proxy, and try again. Reason=%s"

[Log_wrangler]

So I was testing the SNOW TA with data from a URL like dev.company.servicenow.com.

I was only collecting two tables sys_email and syslog_transaction, worked great for weeks.

Today I switched out the URL to prod.company.servicenow.com, and changed the password. Username stayed the same and table permissions were the same.

When I changed the pwd I got this error
Encountered the following error while trying to update: Error while posting to url=/servicesNS/nobody/Splunk_TA_snow/service_now_setup/snow_proxy/snow_proxy

I ran a query and got some data, but it stopped at 2000 events.

I checked service_now.conf and it shows the new password. So it looks like it took.

When I check splunkd.log, I see:

ERROR AdminManagerExternal - Failed to validate ServiceNow account or detect release info. Please verify credentials, urls for ServiceNow and proxy, and try again. Reason=%s

Please advise how to troubleshoot this.

Thank you

[Log_wrangler · Accepted solution]

So I got it to work again after repeated username and password saves!!!

IMO this TA seems buggy... just saying