We are limited by what ServiceNow Api returns. ... View more

maybe your dashboard doesnt have permission to the OSSEC app? It works on my end which means could be permission. Either check permission or more those panels to the app that contains the dashboard in question ... View more

I still see the pre-built panels are still part of the TA under Splunk_TA_ossec/default/data/ui/panels/. You should not lose any dashboard built using those panels unless you have them saved in the default folder. ... View more

this is correct. This part of the doc needs to be updated since the App has that covered as part the latest release 4.0.3. We will get the doc fixed ... View more

the latest release of the app supports that new format. ... View more

Do you see any error when you run: index=_internal sourcetype="splunk_app_addon-builder*" It might be browser security settings related. Can you clarify: -what browser you are using? -did you try different browser? ... View more

Setting server name should not cause 127.0.0.1 to be inaccessible. it should always be accessible otherwise this could indicate network configuration issue. also, 403 is indicative of authentication failure and not access issue. What happens if you ping 127.0.0.1 from the server itself. do you get any reply? ... View more

Hi If the goal is to use the OSSEC data as part of ES, what does the App give you that the add-on doesnt? Add-on is CIM compatible and renaming the sourcetypes would break add-on knowledge extraction. Sorry cant speak for the app but just wondering about the above. ... View more

The error could be misleading and could be related to bad setup information. I would start by validating that: 1- ServiceNow URL has the right format - something like https://mycompany.service-now.com and make sure its accessbile 2- Make sure you can login using the same creds 3- if there is any proxy, make sure you set it up in the add-on. ... View more

i would suggest to file a support ticket and attach diag for us to take a look. It might be easier that way. ... View more

Thanks. Can you paste any error from the internal logs? Index=_internal error snow ... View more

is this on windows? what version of splunk are you using ? ... View more

You need to have the add-on installed on a HFW or Light W. forwarder and on the console server for data collection. http://docs.splunk.com/Documentation/AddOns/latest/MSSCOM/Install from the doc: Splunk recommends using a heavy forwarder for data collection because the add-on requires Python and the Splunk Add-on for Microsoft SCOM UI is recommended to configure inputs. The Splunk Add-on for Microsoft SCOM and the forwarder must be installed on the same machine as the SCOM Operations console. ... View more

Not an option in the add-on itself and not sure if SNOW API allows it. You can add a props entry to filter unwanted incidents and send them to null Queue. https://answers.splunk.com/answers/59370/filtering-events-using-nullqueue.html ... View more

Certificate is needed to refresh the token automatically but not required for the oAUTH handshake. This could be either one of the following: Make sure the redirect is copied from the Add Account dialog in the Add-on itself. Should have the following format: http://:8000/en-US/app/Splunk_TA_microsoft-cloudservices/redirect http(s)://:8000/ is the actual url you are using to access splunk. Internal IP is ok here as long as as it is accissble. Make sure you are using azure admin to login to Azure in that handshake. those credentials wont be saved on the splunk side. Its just used to generate the token. Make sure you Azure App permission match what the doc states ... View more

Creating the event is now part of the Servicenow Add-on and not app. I would suggest to try with the latest Add-on and see if it works. If you have custom em_event table, that could be an issue here. are any of the custom fields in em_event table required to submit an event? if this is the case, that would be an unsupported scenario. ... View more

Hi, How did you generate the certificate. Did you use openssl? ... View more

Hi, Edit the following url: https://mysinstance.service-now.com/cmdb_ci_list.do?JSONv2&sysparm_query=sys_created_on>=2000-01-01+00:00:00^ORDERBYsys_created_on&sysparm_record_count=50 mysinstance.service-now.com with your service now instance name cmdb_ci_list with the service now table you are trying to query 2000-01-01 with the actual date you want to query from and paste it in your browser. You will be prompted to login, so make sure you do with the same username password you use in the Add-on setup. Check the results for the following: 1- Do you get the historical data you expected to have? 2- Do you get sys_updated_on field returned in each event? If not, this is a permission issue. ... View more

The modular alert feature of the service now add-on does not currently expose the drill down url to allow you to override the value. I would suggest to use the custom command instead and leverage the spunk_url argument. You can use the examples here: http://docs.splunk.com/Documentation/AddOns/latest/ServiceNow/Usecustomsearchcommands ... View more