Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kdroddy
kdroddy
Explorer
Member since:
02-21-2020
09-14-2023
Community Statistics
| Posts | 11 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 02-21-2020 |
Activity Feed
- Posted Re: ServiceNow - sys_user_group input is not pulling from the servicenow table sys_user_group on All Apps and Add-ons. 07-25-2020 10:46 AM
- Posted Re: Getting error while adding ServiceNow incident through Splunk add-on: "Failed to create ticket..." on Splunk Dev. 07-25-2020 10:29 AM
- Posted ServiceNow Add-On not working after upgrading from 7.3.2 to 8.0.2.1: Getting SSL certificate errors. on All Apps and Add-ons. 07-08-2020 01:38 PM
- Karma Re: Remove duplicate rows based on condition for richgalloway. 06-14-2020 07:18 AM
- Posted KV Store Update Multiple Records on Knowledge Management. 04-29-2020 06:14 PM
- Tagged KV Store Update Multiple Records on Knowledge Management. 04-29-2020 06:14 PM
- Tagged KV Store Update Multiple Records on Knowledge Management. 04-29-2020 06:14 PM
- Tagged KV Store Update Multiple Records on Knowledge Management. 04-29-2020 06:14 PM
- Tagged KV Store Update Multiple Records on Knowledge Management. 04-29-2020 06:14 PM
- Tagged KV Store Update Multiple Records on Knowledge Management. 04-29-2020 06:14 PM
- Posted Re: Splunk Add-on for ServiceNow：about the table "sys_audit_delete" on Splunk Search. 03-24-2020 12:07 PM
- Posted Re: Splunk Add-on for ServiceNow：about the table "sys_audit_delete" on Splunk Search. 03-17-2020 06:09 PM
- Posted Re: How do I add custom behavior for one dashboard panel? on Dashboards & Visualizations. 03-03-2020 04:45 PM
- Posted Re: Splunk Add-on for ServiceNow：about the table to get (inputs.conf) on All Apps and Add-ons. 03-03-2020 04:41 PM
- Posted Re: Splunk Add-on for ServiceNow：about the table to get (inputs.conf) on All Apps and Add-ons. 03-02-2020 02:00 PM
- Posted Re: Splunk add-on for ServiceNow Setup Error - "Unable to reach server at https://~.service-now.com/. Check configurations and network settings." on All Apps and Add-ons. 03-02-2020 01:52 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
07-25-2020
10:46 AM
Since you already have that data in Splunk, have you considered copying over the buckets from the test index to the production index? I believe the ServiceNow TA tracks the last update from a given table to avoid duplicates. That is why when you change the index it just continues from the most recent update from that table.
... View more
07-25-2020
10:29 AM
Hello, When you go to ServiceNow, under "Installation Checklist": Are the appropriate steps list as "Complete" under "Task Status"?
... View more
07-08-2020
01:38 PM
Details:
ServiceNow Kingston/Splunk 7.3.2 (on-prem) integration was working perfectly with the ServiceNow Add-On 5.0.1. The only mods I made to the OOTB configuration was to add the proper certs to the HTTP object in the Splunk account validation script via http.add_certificate(foo bar) and add the SNOW cert chain to cacerts.txt within the add-on.
Upon upgrading to 8.0.2.1 the integration is no longer functioning. When I try to connect to SNOW I'm getting SSL certificate errors, even though the setup I used for 7.3.2 is the same.
Just curious if anyone has had the same or similar issues with upgrade Splunk to 8.x??
... View more
Labels
- Labels:
-
configuration
-
upgrade
04-29-2020
06:14 PM
Quick question about KV store - wondering what the best way to update multiple records at once via search may be?
Example - let's say I have the most recent logon for users for the past week:
user1 - last_logon_time
user2 - last_logon_time
etc....
I would like to query last_logon_time for all users for the past day, then update the KV store with the most recent info. The goal would be to set this up as a schedule search running daily to keep the KV store updated.
Any thoughts?
... View more
Labels
- Labels:
-
kvstore
03-24-2020
12:07 PM
How did your test go?
... View more
03-17-2020
06:09 PM
Hi,
Are you successfully grabbing data from your other inputs (sysevent & sys_update_xml) using the same 'snow_account'?
... View more
03-03-2020
04:45 PM
Have you check out the 'depends' command to see if that will work for your needs?
https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/PanelreferenceforSimplifiedXML
... View more
03-03-2020
04:41 PM
Hey, in this case you can just add sys_update_xml as an entry in the inputs.conf file yourself. Make a new stanza and fill in whichever fields you need for it:
[snow://sys_update_xml]
timefield = sys_created_on
table = sys_update_xml
duration = 60
etc..
... View more
03-02-2020
02:00 PM
You can either add your own entry into the inputs.conf file for each table you want to retrieve, or simply add it under the 'Inputs' tab of the app within Splunk.
... View more
03-02-2020
01:52 PM
Have you checked the logs for more information on the error being thrown? You can do so at index=_internal sourcetype="ta_snow". This should give you some additional insight into the connectivity issue.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-14-2023
10:52 PM
|
