Splunk Add-on for ServiceNow - Data is not ingesting from a specific table of ServiceNow in the Splunk.

Applicability

Description

Splunk is not ingesting data from a particular table of ServiceNow using the Splunk add-on for ServiceNow. 

Investigation

Check the logs for the Splunk add-on for ServiceNow (Enabling the Debug mode under Apps > Splunk add-on for SNOW > Configuration > Logging).

Run the below SPL query to check the internal logs for the specific input data that is not ingesting.

index=_internal sourcetype=*snow* *<input_name>*

Below is the error found in the internal logs.

Error: During the call, the following error was found while fetching the data:
File "/opt/splunk/etc/apps/Splunk_TA_snow/bin/snow_data_loader.py", line 343, in _write_events_to_event_writer
obj[timefield],
1%Y-%m-%d %H:%M:
KeyError: 'sys_created_on'

Resolution

The required table was locked, and access was restricted due to limited resources on the ServiceNow side. After unlocking the table in ServiceNow, re-running the input successfully ingested the details from the table.