All Apps and Add-ons

Why the error after installing Splunk add-on for ServiceNow in local Splunk Enterprise?

wangzhaoyu
New Member

Hello,

I've installed Splunk Addon for ServiceNow in my local Splunk Enterprise. In the setup page, enter required information, after clicking 'save', I got error message : Encountered the following error while trying to update: Splunkd daemon is not responding: (u"Error connecting to /servicesNS/nobody/Splunk_TA_snow/apps/local/Splunk_TA_snow/setup: ('The read operation timed out',)",)

How can I fix this issue? Thanks!

Labels (3)
0 Karma

dr5mn
Explorer

Getting the same error. Saw another thread about the same issue, but posting my error here as well:

 

Hi

 

Getting the same when trying to change or update a local event log collection.

 

I started out by setting up local logging. I selected all possible windows events - perhaps this was a bit too eager as it zapped up my entire free quota for the day. 

 

I then tried to remove some event types, but have been getting that error ever since.

 

Any ideas on how to fix this?

 

dr5mn_0-1648152330818.png

 

0 Karma

p_gurav
Champion

Is credentials you are using correct? Try setting up the add-on using service_now.conf instead of using Splunk Web

0 Karma

wangzhaoyu
New Member

yes, the credentials is correct.
I've tried modified service_now.conf manually, but the username and password always be rewritten as "encrypted" in local/service_now.conf. Is that correct?

By the way, where can I set the index and sourcetype in this Add-on?

0 Karma

p_gurav
Champion

Yes the credentials get encrypted once you restart service.

Also you can create inputs.conf to specify index and sourcetype, check below link:
https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Configureinputs

Can you check in _internal index, eventtype=snow_setup_error for any configuration errors?

0 Karma

wangzhaoyu
New Member

thank you so much. The Splunk_TA_snow works in my machine 🙂

but there is another question, I would like to specify the "display_value" for each ticket type.

I set "display_value = all" in service_now.conf, specify fields in inputs.conf like below, but still get all fields of incident_sla. how can I do that? thanks!
[snow://incident_sla]
display_value = inc_closed_at,inc_state,inc_number,inc_cmdb_ci,inc_priority,inc_category,inc_u_region

0 Karma

p_gurav
Champion
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...