Due to some reasons account setup and Data input is not working well , its just a loading screen but no response . I find another way to solve this case.
1. Go to “$SPLUNK_HOME/etc/apps/Splunk_TA_snow” and make a new folder named “local”
2. Copy “Splunk_TA_snow/default/service_now.conf” to “$SPLUNK_HOME/etc/apps/Splunk_TA_snow/local”
3. Open it and will configure it .
4. Paste this code to your service_now.conf file.
[snow_default]
collection_interval = 120
priority = 10
record_count = 5000
loglevel = INFO
since_when = 2000-01-01 00:00:00
display_value = false
[snow_account]
url = “INPUT YOUR URL HERE ”
release = jakarta
username = “INPUT YOUT USERNAME HERE”
password = “INPUT YOUT PASSWORD HERE”
[snow_proxy]
proxy_enabled = 0
proxy_url =
proxy_port =
proxy_username =
proxy_password =
proxy_rdns = 0
proxy_type = http
5.Now save it .
6. Next is we will configure the inputs of your data.
7. Copy “$SPLUNK_HOME/etc/apps/Splunk_TA_snow/default/inputs.conf” to “$SPLUNK_HOME/etc/apps/Splunk_TA_snow/local”.
8. Edit it and replace the first half of the code with the code below ,
[snow]
index = main
timefield = sys_updated_on
exclude =
disabled = false
interval = 60
start_by_shell = false
[snow://incident]
exclude = description
disabled = false
[snow://problem]
exclude = description
disabled = false
[snow://em_event]
timefield = time_of_event
disabled = false
9.Save it.
10. Now we will Enable your saved searches .
11. Go to $SPLUNK_HOME/etc/apps/Splunk_TA_snow/default/savedsearches.conf.
12. Copy the file to “ /local”
13. Open It and for each search that you want to enable, change Disabled = 1 to Disabled = 0, for me i enable it all.
14. And you restart your Splunk so it can reload all the .conf files
Thats how i fix the issue, hope it helps you
... View more
