All Apps and Add-ons

Unable to configure Splunk App for Service Now through Configuration window

ashrafk
Explorer

I have installed Splunk on my computer and installed Service Now app on that. But I am unable to configure the app through “Account Setup “ , the page stops at “ Loading “ and Nothing loads. I am not getting the page where i would be updating my credentials. I have tried updating the Service Now.Conf file as well But of no use.

Tags (1)
0 Karma

jadengoho
Builder

Due to some reasons account setup and Data input is not working well , its just a loading screen but no response . I find another way to solve this case.
1. Go to “$SPLUNK_HOME/etc/apps/Splunk_TA_snow” and make a new folder named “local”
2. Copy “Splunk_TA_snow/default/service_now.conf” to “$SPLUNK_HOME/etc/apps/Splunk_TA_snow/local”
3. Open it and will configure it .
4. Paste this code to your service_now.conf file.

[snow_default]
collection_interval = 120
priority = 10
record_count = 5000
loglevel = INFO
since_when = 2000-01-01 00:00:00
display_value = false

[snow_account]
url = “INPUT YOUR URL HERE ”
release = jakarta
username = “INPUT YOUT USERNAME HERE”
password = “INPUT YOUT PASSWORD HERE”

[snow_proxy]
proxy_enabled = 0
proxy_url =
proxy_port =
proxy_username =
proxy_password =

proxy_rdns = 0
proxy_type = http

5.Now save it .
6. Next is we will configure the inputs of your data.
7. Copy “$SPLUNK_HOME/etc/apps/Splunk_TA_snow/default/inputs.conf” to “$SPLUNK_HOME/etc/apps/Splunk_TA_snow/local”.
8. Edit it and replace the first half of the code with the code below ,

[snow]
index = main
timefield = sys_updated_on
exclude =
disabled = false
interval = 60
start_by_shell = false

[snow://incident]
exclude = description
disabled = false

[snow://problem]
exclude = description
disabled = false

[snow://em_event]
timefield = time_of_event
disabled = false

9.Save it.
10. Now we will Enable your saved searches .
11. Go to $SPLUNK_HOME/etc/apps/Splunk_TA_snow/default/savedsearches.conf.
12. Copy the file to “ /local”
13. Open It and for each search that you want to enable, change Disabled = 1 to Disabled = 0, for me i enable it all.
14. And you restart your Splunk so it can reload all the .conf files

Thats how i fix the issue, hope it helps you

0 Karma

jadengoho
Builder

Do you solve the problem already , may i know how do you solve it ?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...