getsnow configuration

[pkeller]

Been trying to configure the getsnow app. A couple of questions.

• is it supported on a search head cluster?
• when i create a [production] stanza including 'user' and 'password' settings, is the clear-text password supposed to get encyrpted?
• getsnow.log gets created but there is never any data written.
• |getsnow table="" doesn't seem to return any data at all.
• the 'getsnow' search also returns a number of errors from our indexer pool, which seems odd. Is getsnow required to be installed on the indexing layer as well?

Thank you

[pkeller · Accepted solution]

bmacias84 provided the solution to my question. - thank you

[bmacias84]

Hello @pkeller,

I am working on a new version of the app. Which simplifies things. The new version will contain three new command snowincident, snowtask, snowuser.

snowincident - pulls incidents by users or assignment group looks up sys_id.
snowtask - pulls tasks by users or assignment group looks up sys_id.
snowuser - pulls user information, assigned assets, and last 10 incidents for user.

• is it supported on a search head cluster? Yes it does work in SHC

• when i create a [production] stanza including 'user' and 'password' settings, is the clear-text password supposed to get encyrpted? No, it made it easier to implement is Search Head Pooling and in SHC.

• getsnow.log gets created but there is never any data written. Never got around to finishes logging

• |getsnow table="" doesn't seem to return any data at all. It should attempt to pull data from the incident table. The user is still required to have read permission to any ServiceNow table you query.

• the 'getsnow' search also returns a number of errors from our indexer pool, which seems odd. Is getsnow required to be installed on the indexing layer as well? In the version of the SDK i used and depending on the version of Splunk their is a bug where Splunk ignores local=true flag which tells the search processor this is a Search head only command. The fix is to set @Configuration(local=True) in the code and in the config file.

[pkeller]

Thank you ... that resolved my issue ... I also had to change another line in getsnow.py

from:
sysparam_query = '?sysparm_display_value=all%s%s%s' % ('&sysparm_query=', '^'.join(self.filters.split(',')), time_range) if self.filters else 'sysparm_limit=1'

to:
sysparam_query = '?sysparm_display_value=all%s%s%s' % ('&sysparm_query=', '^'.join(self.filters.split(',')), time_range) if self.filters else ‘?sysparm_limit=1’

I'm now getting the json output returned in the UI.

Thanks very much.

[bmacias84]

If you would like to play around with the latest version. you can download it at https://github.com/httpstergeek/getsnow. Its about 2 weeks from being published in the app store.