What endpoint are you using in the custom action configuration?  I found that if i used something like /api/now/table/incident instead of /api/now/table/x_splu2_splunk_ser_u_splunk_incident(recommended by the alert action gui), I would get new incidents every time.  The downside of using the recommended endpoint is that an intermediate table gets populated in ServiceNow.  The upside is that it does correlations based on the correlation ID sent over from the alert action.  That correlation ID is a hash of the alert name so any future actions that go across to ServiceNow will still correlate under that correlation ID (and originally created incident) and not create new incidents. ... View more

I had the same issue and coudn't fix it by following the guidelines above and updating the binaries in: $SPLUNK_HOME/etc/apps/Splunk_TA_checkpoint-opseclea/bin/opsec-tools I fixed it this way: 1. I saw that the new SIC certificate was PULLED SUCCESSFULLY from the CheckPoint server regardless the error message "External handler failed with code '1' and output: 'REST ERROR[400]: Bad Request..." The certificate was available in "$SPLUNK_HOME/etc/apps/Splunk_TA_checkpoint-opseclea/certs" 2. I manually editted the opseclea_connection.conf in "$SPLUNK_HOME/etc/apps/Splunk_TA_checkpoint-opseclea/local" and added the new certificate under the problematic connection stanza: [connection_stanza_name] cert_name = connection_1234567890.p12 <-- Put the name of the new certificate here fw_version = R80 lea_app_name = Splunk_Server_LEA lea_server_auth_port = 18184 lea_server_auth_type = sslca lea_server_ip = 10.10.10.10 lea_server_type = primary management_server_ip = 10.10.10.11 opsec_entity_sic_name = CN=***,O=*** opsec_sic_name = CN=Splunk_Server_LEA,O=*** disabled = 0 No need to restart splunkd! The connection started working right away. No error messages anymore. I hope it helps colleagues who had the same issue. ... View more

@ab374134  Did you try enabling the input "vmstat.sh" of the add-on? This input leverages the same command that you want to get the required information from. Hope this helps. ... View more

@carylin  The logs for Splunk Add-on for Unix and Linux are falling under the splunkd.log file. So, you can search the logs using the query "index=_internal sourcetype=splunkd ERROR NIX" with an appropriate timestamp for troubleshooting the issues in your environment. Hope this helps. ... View more

This may be due to ServiceNow implementing TLSv1.2 and requiring SNI for connections to the server. Try the following: /bin/splunk cmd openssl s_client -connect yoursnowurl.service-now.com:443 If you receive an SSL handshake error, your ServiceNow instance has likely implemented TLSv1.2. You should also check the ServiceNow app's logs for "SSLEOFError: EOF occurred in violation of protocol" errors. Next, run the following command. If it connects successfully, TLSv1.2 and SNI have been implemented. /bin/splunk cmd openssl s_client -connect yoursnowurl.service-now.com:443 -servername yoursnowurl.service-now.com The current version of the Splunk Add-on for ServiceNow app has an older version of the httplib2 library that does not work with SNI. Go to https://github.com/httplib2/httplib2/tree/master/python2 and download a copy of the httplib2 folder. Backup the httplib2 folder in the bin folder of the ServiceNow app and replace it with the version you downloaded. Try adding your ServiceNow account through the Splunk web interface again. ... View more