Been trying to configure the getsnow app. A couple of questions.
I am working on a new version of the app. Which simplifies things. The new version will contain three new command snowincident, snowtask, snowuser.
snowincident - pulls incidents by users or assignment group looks up sysid.
snowtask - pulls tasks by users or assignment group looks up sysid.
snowuser - pulls user information, assigned assets, and last 10 incidents for user.
is it supported on a search head cluster? Yes it does work in SHC
when i create a [production] stanza including 'user' and 'password' settings, is the clear-text password supposed to get encyrpted? No, it made it easier to implement is Search Head Pooling and in SHC.
getsnow.log gets created but there is never any data written. Never got around to finishes logging
|getsnow table="" doesn't seem to return any data at all. It should attempt to pull data from the incident table. The user is still required to have read permission to any ServiceNow table you query.
the 'getsnow' search also returns a number of errors from our indexer pool, which seems odd. Is getsnow required to be installed on the indexing layer as well? In the version of the SDK i used and depending on the version of Splunk their is a bug where Splunk ignores local=true flag which tells the search processor this is a Search head only command. The fix is to set @Configuration(local=True) in the code and in the config file.
Thank you ... that resolved my issue ... I also had to change another line in getsnow.py
sysparamquery = '?sysparmdisplayvalue=all%s%s%s' % ('&sysparmquery=', '^'.join(self.filters.split(',')), timerange) if self.filters else 'sysparmlimit=1'
sysparamquery = '?sysparmdisplayvalue=all%s%s%s' % ('&sysparmquery=', '^'.join(self.filters.split(',')), timerange) if self.filters else ‘?sysparmlimit=1’
I'm now getting the json output returned in the UI.
Thanks very much.