Splunk Search

App ServiceNow (SNOW) - Lookup File Errors for ServiceNow App.

dkolekar_splunk
Splunk Employee
Splunk Employee

The lookup table 'xxxxx_xxxx_xxxx' does not exist. It is referenced by configuration 'snow:change_request'.

Add-on version: 3.1.2

Description:
Errors occur on lookup files when trying to use the Splunk app for ServiceNow.

How to identify it:
1. Customer will receive the next errors:
5 errors occurred while the search was executing. Therefore, search results might be incomplete.

[hostname.com] Info.csv being bloated by "lookup" log messages . Will not log additional errors. Refer search.log
[hostname.com] The lookup table 'change_state_lookup' does not exist. It is referenced by configuration 'snow:change_request'.
[hostname.com] The lookup table 'change_state_lookup' does not exist. It is referenced by configuration 'snow:change_task'.
[hostname.com] The lookup table 'cmdb_ci_list_lookup' does not exist. It is referenced by configuration 'snow:change_request'.
[hostname.com] The lookup table 'cmdb_ci_list_lookup' does not exist. It is
2. Lookup files from Splunk app for SeviceNow creating lookup files over 1GB in size

Tags (1)
0 Karma
1 Solution

dkolekar_splunk
Splunk Employee
Splunk Employee

In order to resolve this issue, we need to reduce the bundle size.

Performance issue caused by large bundle replication
The two largest lookups, cmdb_ci_list_lookup.csv and cmdb_rel_ci.csv, cause performance issues with the ServiceNow app 4.0.2 because they are excessively large. To resolve this performance issue, upgrade to Splunk App for Servicenow 4.0.3, which no longer uses these two lookups, then disable the following two saved searches:

ServiceNow CMDB CI Relation
ServiceNow CMDB CI List

Related Links

Lookups for the Splunk Add-on for ServiceNow
http://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Lookups

Remove deleted configuration items from the configuration management database lookups
http://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Troubleshooting#Remove_deleted_confi...

View solution in original post

Roy99
Contributor

Hi @dkolekar_splunk 
Can you help me with Snow incident geographical dashboard, i have already enabled incident table and location table inputs using the add-on, but i am unable to correlate this and populate the dashboard. there is no common field between two tables like latitide, longitude or location? Did you ever faced this issue?

Please help me out.

 

Thanks

0 Karma

dkolekar_splunk
Splunk Employee
Splunk Employee

In order to resolve this issue, we need to reduce the bundle size.

Performance issue caused by large bundle replication
The two largest lookups, cmdb_ci_list_lookup.csv and cmdb_rel_ci.csv, cause performance issues with the ServiceNow app 4.0.2 because they are excessively large. To resolve this performance issue, upgrade to Splunk App for Servicenow 4.0.3, which no longer uses these two lookups, then disable the following two saved searches:

ServiceNow CMDB CI Relation
ServiceNow CMDB CI List

Related Links

Lookups for the Splunk Add-on for ServiceNow
http://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Lookups

Remove deleted configuration items from the configuration management database lookups
http://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Troubleshooting#Remove_deleted_confi...

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!