Hi Community,
we've setup the Splunk Add-On for ServiceNow to send Splunk events/alerts to our ServiceNow platform. While using OAuth 2.0 for the integration, we're facing a particular problem where no events are sent to ServiceNow and we get this error :
Failed to create ticket. Return code is 401 (Unauthorized). Failure potentially caused by expired access token
The problem seems to be related to our Refresh Token Lifespan. Our security prerequesite is that Token should be refreshed every 60 minutes and is set that way in ServiceNow Application Registry. The default value is 100 days in ServiceNow which seems very high.
In the service now documentation it mentions this :
Configure the value of the
Refresh Token Lifespan parameter as high as possible so that it does not expire. Once the refresh token expires, you have to reconfigure the account
. Source
Any idea why we're having this problem and the reason why we have to leave the value high? My understanding is that if the token expires, the add-on should be able to go get a new access token.
Thanks!
