Upon initial index of Service Now data, only records with the current date are being retrieved even though a specific date of a year ago is specified in the input.conf file. Looked in splunk_ta_snow_util.log file and error msg:
2016-03-24 07:24:51,088 ERROR pid=7016 tid=Thread-11 file=thread_pool.py:run:259 | Traceback (most recent call last):
File "C:\Program Files\Splunk\etc\apps\Splunk_TA_snow\bin\framework\thread_pool.py", line 257, in _run
func()
File "C:\Program Files\Splunk\etc\apps\Splunk_TA_snow\bin\snow_job_factory.py", line 37, in __call_
config.get("record_count", 10000))
File "C:\Program Files\Splunk\etc\apps\Splunk_TA_snow\bin\snow_data_loader.py", line 106, in collect_data
self._write_checkpoint(table, timefield, jobjs, refreshed)
File "C:\Program Files\Splunk\etc\apps\Splunk_TA_snow\bin\snow_data_loader.py", line 232, in _write_checkpoint
latest_timestamp = jobjs[-1][timefield]
KeyError: u'sys_updated_on'
... View more