So I was testing the SNOW TA with data from a URL like dev.company.servicenow.com.
I was only collecting two tables sys_email and syslog_transaction, worked great for weeks.
Today I switched out the URL to prod.company.servicenow.com, and changed the password. Username stayed the same and table permissions were the same.
When I changed the pwd I got this error
Encountered the following error while trying to update: Error while posting to url=/servicesNS/nobody/Splunk_TA_snow/service_now_setup/snow_proxy/snow_proxy
I ran a query and got some data, but it stopped at 2000 events.
I checked service_now.conf and it shows the new password. So it looks like it took.
When I check splunkd.log, I see:
ERROR AdminManagerExternal - Failed to validate ServiceNow account or detect release info. Please verify credentials, urls for ServiceNow and proxy, and try again. Reason=%s
Please advise how to troubleshoot this.
Thank you
So I got it to work again after repeated username and password saves!!!
IMO this TA seems buggy... just saying
So I got it to work again after repeated username and password saves!!!
IMO this TA seems buggy... just saying