Splunk Servicenow integration

[rksharma2808]

I have integrated splunk wtih servicenow , am getting below error log_level=ERROR pid=531305 tid=MainThread file=snow_data_loader.py:_do_collect:538 | Failure potentially caused by expired access token. Regenerating access token

[rksharma2808]

hello Kiran,

Thank you 

we tried generating new token 

log_level=ERROR pid=403773 tid=Thread-1 file=snow_ticket.py:_handle_response:572 | [invocation_id=d1d96adc92a7437e907573c9d8226bcb] Failed to create ticket. Return code is 500 (Internal Server Error).

[kiran_panchavat]

@rksharma2808 

Check this https://www.servicenow.com/community/developer-forum/unable-to-create-incidents-via-splunk-add-on-fo... 

[livehybrid]

Hi @rksharma2808 

Are you able to change the log level to DEBUG to see if this presents some different logs?

Also - do you get an error when setting up the account in the Service Now app, or when an input runs?

Do you have any logs created with a name like "splunk_ta_snow_main.log" with any useful information?

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

[kiran_panchavat]

@rksharma2808 

The 500 Internal Server Error from ServiceNow when trying to create a ticket usually indicates an issue on the ServiceNow side rather than Splunk. 

Ensure the endpoint is accessible from Splunk (e.g., test via curl or Postman). A 500 error can occur if the payload sent to ServiceNow is malformed or missing required fields. Cross-check the payload fields with ServiceNow's API documentation for ticket creation. If possible, log the payload being sent by Splunk and manually test it using Postman or curl to identify the exact issue.

I would recommend you to setup a call with the ServiceNow team and fix the issue. 

[kiran_panchavat]

@rksharma2808 

As the error message suggests, try regenerating the access token. This can often resolve the issue if the token has expired. Ensure that the new access token has a sufficient expiry time. Sometimes, tokens are set to expire too quickly, causing frequent issues.

If you are hitting API rate limits, ServiceNow might invalidate the token. Verify with your ServiceNow admin if rate limits are being enforced.