Splunk Search

App ServiceNow (SNOW) - Lookup File Errors for ServiceNow App.

Splunk Employee
Splunk Employee

The lookup table 'xxxxxxxxxxxxx' does not exist. It is referenced by configuration 'snow:change_request'.

Add-on version: 3.1.2

Description:
Errors occur on lookup files when trying to use the Splunk app for ServiceNow.

How to identify it:
1. Customer will receive the next errors:
5 errors occurred while the search was executing. Therefore, search results might be incomplete.

[hostname.com] Info.csv being bloated by "lookup" log messages . Will not log additional errors. Refer search.log
[hostname.com] The lookup table 'changestatelookup' does not exist. It is referenced by configuration 'snow:changerequest'.
[hostname.com] The lookup table 'change
statelookup' does not exist. It is referenced by configuration 'snow:changetask'.
[hostname.com] The lookup table 'cmdbcilistlookup' does not exist. It is referenced by configuration 'snow:changerequest'.
[hostname.com] The lookup table 'cmdbcilist_lookup' does not exist. It is
2. Lookup files from Splunk app for SeviceNow creating lookup files over 1GB in size

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

In order to resolve this issue, we need to reduce the bundle size.

Performance issue caused by large bundle replication
The two largest lookups, cmdbcilistlookup.csv and cmdbrel_ci.csv, cause performance issues with the ServiceNow app 4.0.2 because they are excessively large. To resolve this performance issue, upgrade to Splunk App for Servicenow 4.0.3, which no longer uses these two lookups, then disable the following two saved searches:

ServiceNow CMDB CI Relation
ServiceNow CMDB CI List

Related Links

Lookups for the Splunk Add-on for ServiceNow
http://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Lookups

Remove deleted configuration items from the configuration management database lookups
http://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Troubleshooting#Remove_deleted_confi...

View solution in original post

Splunk Employee
Splunk Employee

In order to resolve this issue, we need to reduce the bundle size.

Performance issue caused by large bundle replication
The two largest lookups, cmdbcilistlookup.csv and cmdbrel_ci.csv, cause performance issues with the ServiceNow app 4.0.2 because they are excessively large. To resolve this performance issue, upgrade to Splunk App for Servicenow 4.0.3, which no longer uses these two lookups, then disable the following two saved searches:

ServiceNow CMDB CI Relation
ServiceNow CMDB CI List

Related Links

Lookups for the Splunk Add-on for ServiceNow
http://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Lookups

Remove deleted configuration items from the configuration management database lookups
http://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Troubleshooting#Remove_deleted_confi...

View solution in original post