Join the Conversation
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- All Apps and Add-ons
- :
- Re: Why does the Splunk Add-on for ServiceNow stop...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have an issue where the Splunk Add-on for ServiceNow no longer indexes data when the ServiceNow service is updated/restarted. We need to manually restart the Splunk instance which runs the ServiceNow add-on to fix this.
I think there is an issue with the authentication token or something equivalent. The sessions don't seem to be valid anymore and a restart of Splunk fixes this.
Anybody else with this issue as well? Is there a way to fix this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have removed the proxy server between the Splunk instance running the snow scripts and ServiceNow and the issue is gone. This case is closed 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have removed the proxy server between the Splunk instance running the snow scripts and ServiceNow and the issue is gone. This case is closed 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We had a similar issue, where ServiceNow logs were no longer getting indexed. A restart of Splunk resolved the issue for us. I am not really sure what triggered it to stop getting logs though.
I noticed a new version of the TA is available (we are running v 2.7.0, and 2.9.0 is available.) Not sure if that will resolve the issue or not.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We supect the proxy server to drop the connection. This way the ServiceNow add-on doesn't function anymore untill a restart of Splunk.
We have upgraded the add-on to the latest and greatest version but that doesn't help.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
