Splunk Add-on for ServiceNow data not ingesting due to insufficient permissions

Applicability

Description

Splunk Add-on for ServiceNow not ingesting data into Splunk, even after the correct credentials.

Investigation

Checked the internal logs using the SPL below:

index=_internal sourcetype = *ta_snow* *ERROR*

And found the below ERROR logs:

2024-11-27 08:20:42,029 ERROR pid=2429829 tid=MainThread file=snow_data_loader.py:collect_data:274 | Failure occurred while getting records for the input: sgesiv_dev_sys_audit from the table: sys_audit of the servicenow host: https://<SNOW_ENDPOINT>.service-now.com/. The reason for failure= {'message': 'User Not Authorized', 'detail': 'User is unauthorized to access table: sys_audit'}. Contact Splunk administrator for further information.
2024-11-27 08:26:22,589 ERROR pid=2439839 tid=MainThread file=snow_data_loader.py:collect_data:274 | Failure occurred while getting records for the input: sgesiv_dev_ecc_queue from the table: ecc_queue of the servicenow host: https://<SNOW_ENDPOINT>.service-now.com/. The reason for failure= {'message': 'Insufficient rights to query records', 'detail': 'Field(s) present in the query do not have permission to be read'}. Contact Splunk administrator for further information

From the ERRORs there is an Unauthorised error and a Foriddon Error message. So, both are permission-related related.

Resolution

The error states that the user does not have access to the specified table. Need to validate the with ServiceNow admin team in this case and resolve these permission issues. Once the user can access the table using the API, the TA should work too.

Related Links

Configure ServiceNow to integrate with the Splunk platform
Configure inputs for the Splunk Add-on for ServiceNow