Can you please say, what do we need to enable on servicenow instance to send it's log to splunk. I enabled sysevent and syslog_audit on splunk instance. But not receiving logs. What to do?  ... View more

I had similar issue, the difference is that my TA has inputs for multiple tables. All the inputs work ok with 3000 record count except one of them. Once I adjusted the problematics input to  1000 record count, events started to be ingested.  why only experiencing issues with one of them.  Error reported for this input is: The reason for failure= {'message': 'Transaction cancelled: maximum execution time exceeded', 'detail': 'maximum execution time exceeded Check logs for error trace or enable glide.rest.debug property to verify REST request processing'}.   any suggestions will be appreciated.    ... View more

Reducing it all to 1000 seems to have done the magic for us. We are still evaluating it, but we doesn't seem to see those error messages frequently anymore. Thanks! ... View more