Why does the Splunk Add-on for ServiceNow stop indexing data when the ServiceNow service is updated/restarted?

[cmeerbeek]

We have an issue where the Splunk Add-on for ServiceNow no longer indexes data when the ServiceNow service is updated/restarted. We need to manually restart the Splunk instance which runs the ServiceNow add-on to fix this.
I think there is an issue with the authentication token or something equivalent. The sessions don't seem to be valid anymore and a restart of Splunk fixes this.

Anybody else with this issue as well? Is there a way to fix this?

[cmeerbeek · Accepted solution]

We have removed the proxy server between the Splunk instance running the snow scripts and ServiceNow and the issue is gone. This case is closed 🙂

[gn694]

We had a similar issue, where ServiceNow logs were no longer getting indexed. A restart of Splunk resolved the issue for us. I am not really sure what triggered it to stop getting logs though.
I noticed a new version of the TA is available (we are running v 2.7.0, and 2.9.0 is available.) Not sure if that will resolve the issue or not.

[cmeerbeek]

We supect the proxy server to drop the connection. This way the ServiceNow add-on doesn't function anymore untill a restart of Splunk.
We have upgraded the add-on to the latest and greatest version but that doesn't help.