I've installed Splunk Addon for ServiceNow in my local Splunk Enterprise. In the setup page, enter required information, after clicking 'save', I got error message : Encountered the following error while trying to update: Splunkd daemon is not responding: (u"Error connecting to /servicesNS/nobody/Splunk_TA_snow/apps/local/Splunk_TA_snow/setup: ('The read operation timed out',)",)
How can I fix this issue? Thanks!
Getting the same error. Saw another thread about the same issue, but posting my error here as well:
Getting the same when trying to change or update a local event log collection.
I started out by setting up local logging. I selected all possible windows events - perhaps this was a bit too eager as it zapped up my entire free quota for the day.
I then tried to remove some event types, but have been getting that error ever since.
Any ideas on how to fix this?
yes, the credentials is correct.
I've tried modified service_now.conf manually, but the username and password always be rewritten as "encrypted" in local/service_now.conf. Is that correct?
By the way, where can I set the index and sourcetype in this Add-on?
Yes the credentials get encrypted once you restart service.
Also you can create inputs.conf to specify index and sourcetype, check below link:
Can you check in _internal index, eventtype=snow_setup_error for any configuration errors?
thank you so much. The Splunk_TA_snow works in my machine 🙂
but there is another question, I would like to specify the "display_value" for each ticket type.
I set "display_value = all" in service_now.conf, specify fields in inputs.conf like below, but still get all fields of incident_sla. how can I do that? thanks!
display_value = inc_closed_at,inc_state,inc_number,inc_cmdb_ci,inc_priority,inc_category,inc_u_region
In version 3.0.0, the value of display_value is changed to all by default in Splunk Add-on for ServiceNow.
To revert to the previous behavior of collecting the display values using lookups and not directly from the API