Invalid end point for ServiceNow integration

[KeithH]

Hi,  I have installed the "ServiceNow Security Operations Event Ingestion Addon for Splunk Enterprise" app and configured it using Basic Auth.
When I try to send an event I get error:
   command="snsecingest", Unable to forward notable event 

after putting some logging in the python I can see the error behind that is 

{"error":{"message":"Requested URI does not represent any resource","detail":null},"status":"failure"}

Even a simple curl straight to the endpoint fails with the same error.

Does anyone know if this endpoint (supplied with the app) might have changed or does it need to be created for each domain?
Endpoint I have is:

https://XXXXXXdev.service-now.com/api/sn_sec_splunk_v2/event_ingestion

  Any suggestions would be appreciated.
Thanks

[manjunathmeti · Accepted solution]

Hi @KeithH,

Did you configure Service Now to integrate with your Splunk? If not, you can refer to this: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/ConfigureServiceNowtointegratewithS....

[KeithH]

Hi @manjunathmeti 

thanks for the suggestion but why would I do that. 
The link you sent relates to app the "Splunk Add-on for ServiceNow"

whereas I am using the app "ServiceNow Security Operations Event Ingestion Addon for Splunk Enterprise"

Thanks

[manjunathmeti]

The link was just for reference, usually, you need to deploy an app or integration in Service Now first so that the add-on on Splunk integrates with Service Now.

[KeithH]

Ah that makes sense - thanks @manjunathmeti 

I will hassle my servicenow contact and see if I can understand what he has done