I got the same error. I was able to get in by using | snow instance= request=incident action=query Try without using the "service-now.com" in your instance field. Hope this helps. ... View more

@harshal_chakranarayan - I had come across a similar requirement, and used the following app: http://apps.splunk.com/app/570/ (rowcolorizer app) to solve my issue. You have to copy the appserver folder into your app, and change the js and css accordingly to colorize your row according to the particular field. Hope this helps someone. ... View more

Thanks a lot. Increasing the limit on the peers solved the issue for now. We will look into the other proposed solution to "replicationWhitelist or replicationBlacklist that can be defined to further reduce the bundle that needs to be replicated to all peers". Should this 'replicationWhitelist' change be done in the distsearch.conf file on the searchHead or the peers? Thanks! ... View more