Why the error after installing Splunk add-on for ServiceNow in local Splunk Enterprise?

[wangzhaoyu]

Hello,

I've installed Splunk Addon for ServiceNow in my local Splunk Enterprise. In the setup page, enter required information, after clicking 'save', I got error message : Encountered the following error while trying to update: Splunkd daemon is not responding: (u"Error connecting to /servicesNS/nobody/Splunk_TA_snow/apps/local/Splunk_TA_snow/setup: ('The read operation timed out',)",)

How can I fix this issue? Thanks!

[dr5mn]

Getting the same error. Saw another thread about the same issue, but posting my error here as well:

Hi

Getting the same when trying to change or update a local event log collection.

I started out by setting up local logging. I selected all possible windows events - perhaps this was a bit too eager as it zapped up my entire free quota for the day. 

I then tried to remove some event types, but have been getting that error ever since.

Any ideas on how to fix this?

[p_gurav]

Is credentials you are using correct? Try setting up the add-on using service_now.conf instead of using Splunk Web

[wangzhaoyu]

yes, the credentials is correct.
I've tried modified service_now.conf manually, but the username and password always be rewritten as "encrypted" in local/service_now.conf. Is that correct?

By the way, where can I set the index and sourcetype in this Add-on?

[p_gurav]

Yes the credentials get encrypted once you restart service.

Also you can create inputs.conf to specify index and sourcetype, check below link:
https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Configureinputs

Can you check in _internal index, eventtype=snow_setup_error for any configuration errors?

[wangzhaoyu]

thank you so much. The Splunk_TA_snow works in my machine 🙂

but there is another question, I would like to specify the "display_value" for each ticket type.

I set "display_value = all" in service_now.conf, specify fields in inputs.conf like below, but still get all fields of incident_sla. how can I do that? thanks!
[snow://incident_sla]
display_value = inc_closed_at,inc_state,inc_number,inc_cmdb_ci,inc_priority,inc_category,inc_u_region

[p_gurav]

• In version 3.0.0, the value of display_value is changed to all by default in Splunk Add-on for ServiceNow.

• To revert to the previous behavior of collecting the display values using lookups and not directly from the API

• Refer:
  https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Upgrade