All Apps and Add-ons

Why does the Splunk Add-on for ServiceNow stop indexing data when the ServiceNow service is updated/restarted?

Path Finder

We have an issue where the Splunk Add-on for ServiceNow no longer indexes data when the ServiceNow service is updated/restarted. We need to manually restart the Splunk instance which runs the ServiceNow add-on to fix this.
I think there is an issue with the authentication token or something equivalent. The sessions don't seem to be valid anymore and a restart of Splunk fixes this.

Anybody else with this issue as well? Is there a way to fix this?

0 Karma
1 Solution

Path Finder

We have removed the proxy server between the Splunk instance running the snow scripts and ServiceNow and the issue is gone. This case is closed 🙂

View solution in original post

0 Karma

Path Finder

We have removed the proxy server between the Splunk instance running the snow scripts and ServiceNow and the issue is gone. This case is closed 🙂

View solution in original post

0 Karma

Communicator

We had a similar issue, where ServiceNow logs were no longer getting indexed. A restart of Splunk resolved the issue for us. I am not really sure what triggered it to stop getting logs though.
I noticed a new version of the TA is available (we are running v 2.7.0, and 2.9.0 is available.) Not sure if that will resolve the issue or not.

0 Karma

Path Finder

We supect the proxy server to drop the connection. This way the ServiceNow add-on doesn't function anymore untill a restart of Splunk.
We have upgraded the add-on to the latest and greatest version but that doesn't help.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!