Splunk IT Service Intelligence
Highlighted

Splunk ITSI bidirectional ticketing - ServiceNow - snow_hash.csv not found

Path Finder
We are trying to run bidirectional ticketing (ServiceNow) and are experiencing some issues. ITSI v4.3.3, datamodel are working just find far as I know. The correlation search uses snow_hash.csv as input and ouput. But the file are missing, anyone with a quickfix? Should I just manually create it? Anyone know when it is created? Error message from job output when running the correlation search manually:

[subsearch]: File '/opt/splunk/var/run/splunk/csv/snow_hash.csv' could not be opened for reading.
Labels (2)
0 Karma
Highlighted

Re: Splunk ITSI bidirectional ticketing - ServiceNow - snow_hash.csv not found

Path Finder

It was an issue with field exctractions. Did not extract the field sys_updated_on from the servicenow event. Fixed that and then I ran the correlation search to build the csv. 

View solution in original post

Tags (1)
0 Karma