We have an issue where the Splunk Add-on for ServiceNow no longer indexes data when the ServiceNow service is updated/restarted. We need to manually restart the Splunk instance which runs the ServiceNow add-on to fix this.
I think there is an issue with the authentication token or something equivalent. The sessions don't seem to be valid anymore and a restart of Splunk fixes this.
Anybody else with this issue as well? Is there a way to fix this?
We had a similar issue, where ServiceNow logs were no longer getting indexed. A restart of Splunk resolved the issue for us. I am not really sure what triggered it to stop getting logs though.
I noticed a new version of the TA is available (we are running v 2.7.0, and 2.9.0 is available.) Not sure if that will resolve the issue or not.
We supect the proxy server to drop the connection. This way the ServiceNow add-on doesn't function anymore untill a restart of Splunk.
We have upgraded the add-on to the latest and greatest version but that doesn't help.