The url conversaion is natively done by the python library used in the input. The link ref from the solarwinds addon states to avoid using the +. Any chance you can use an alternative query without the use  of +. Maybe you can compute the addition on the splunk side at search time?  ... View more

should be all stanzas under inputs.conf and restmap.conf. Should have an updated version with a fix that would not require this workaround. Send me an email and I can you an updated copy of the TA. Otherwise, i might make it available on splunkbase soon. ... View more

I havent tested it against 8.1. I will need to take a look and update accordingly.  The addon is only needed on the HWF - any chance you can keep the addon on an 8.0x forwarder?   ... View more

Ok If you are using Splunk Add-on for AWS v4.4.0 and v5.1.0 version of the app - the configuration has to be done in the add-on and No longer allowed in the Splunk App in AWS. What you have described as behavior for the configuration tab is expected and it looks like you are doing the configuration in app. Can you please confirm if you are having issues doing the configuration on the add-on instead? ... View more

Can you take a sapshot from inputs tab? How many inputs do you have there? Are they all enabled? ... View more

what error do you get when you run index=internal error solarwinds ... View more

index=_internal error solarwinds what error do you get you type this? ... View more

We ingest what the the Servicenow REST endpoint exposes. This is the call we make https://.service-now.com/.do?JSONv2&sysparm_query=sys_created_on>=2016-01-01+00:00:00^ORDERBYsys_created_on&sysparm_record_count=50 mysinstance.service-now.com at the end we are limited to what SNOW exposes. check with your admin, if there is a way to add more fields. ... View more

are you talking about the ids? If you want to enrich the id with actual namess, check out section "Collect display values directly from the API" http://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Troubleshooting if you you are getting values that are not expected, try to access the data manually outside of Splunk to confirm that it is not a splunk issue. for that check out the "missing data" (same steps apply here) of http://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Troubleshooting ... View more

does enabling extra logging allow you to get the full message using the same API call in the addon? https://technet.microsoft.com/en-us/library/ff461937(v=exchg.160).aspx. ... View more

should work the same way.The only difference is that if you have proxy in your onprem environment, you will need to disable it. ... View more

did you run the setup and whats the url you input in the setup? ... View more

Yes. What do you get when you type index=sfdc Or when you search for: index=_internal error sfdc ... View more

did you check the troubleshooting section of the doc? ... View more

is this a clustered environment? Did you setup/configure the TA? When you click on the Add-on, do you see the "configuration" tab? If config tab doesn't load whats the error? ... View more

did you try to connect to sfdc workbench using the same username and running the same query account query. If it fails, it is most likely permission related. ... View more

Short answer is "Yes". Every time an incident is updated in SNOW, a new entry in the incident table is created with the sys_update_time updated. Splunk ingest these entries/records as separate events using the add-on. Once these events are in Splunk, you can do pretty much whatever you want. You can track changes or dedup by sys_id to get the latest on that incident ... View more

Did you have addon A and addon B open at the same time in two different tabs at some point? This should not happen if you are editing one addon at a time. Otherwise, if you can reproduce this, this is definitely a bug that we haven't seen. ... View more