Splunk Add-on for ServiceNow - Not generating incident for users

Applicability

Splunk Apps Add ons

Description

The administrator was able to generate incidents on Service Now using ServiceNow Add-on but users were unable to do it.

Using Splunk add-on for ServiceNow version 3.1  (no longer supported)
On Splunk Search Head  Version 7.2.3

Receiving error message on snow_ta_ticket.log: 
 

2019-07-30 20:00:01,597 ERROR pid=24194 tid=MainThread file=snow_ticket.py:_get_service_now_
account:158 | username=<encrypted>, password=<encrypted>, url=https://something.com 
2019-07-30 20:00:01,618 ERROR pid=24194 tid=MainThread file=snow_ticket.py:_get_service_now_
account:162 | url=https://something.com, app=Splunk_TA_snow 
2019-07-30 20:00:01,618 ERROR pid=24194 tid=MainThread file=snow_ticket.py:_get_service_now_
account:165 | Failed to get clear credentials for https://something.com

Investigation

Double checked the installation and Configuration of SNOW;

- Starting on the Snow side: 

1. Log in into your Snow instance. 
2. You can install the app from the Service Now Store or 
3. When you download the Splunk_TA_snow and Unzip it, access the file and you will see another file called forExport (these are Service Now updates sets) 
   • These are the mechanisms that Snow uses to add functionality, to do backups and restore. 
4. We will use this to set up Snow to communicate with Splunk. 
5. Grab the latest one. 
6. Go back to your instance and click on update (or retrieve Update Sets). 
7. Then click on import set from xml, choose file and select the file you grabbed before. 
8. Then click on upload. This may take a few seconds. 
9. Then open up the update set by clicking on Splunk integration. 
10. Click on "preview Update set". Don't worry if you get some errors at this point. 
11. Close the window. And check what fail. Select all the messages a and accept them by clicking on "actions on selected rows" 
12. Then click on "Commit the update Set" 
13. We need to add the user that is going to communicate Splunk with Service Now. 
14. So if you are not logged in as administrator on your Service Now account, then you have to elevate your role to security_admin (Just click on the user tab and select "elevate roles") 
15. On the search bar on the left side of your screen type: User admin. This is going to take you to the user administration.
16. Click on users/new users and create the user and the password for this user. 
    • Make sure the password meets the complexity constraints. 
    • Make sure the "Active" and Internal integration user" boxes are checked. 
17. Under the Roles option click on "edit" 
18. Select the role x_splu2_splunk_ser.Splunk 
19. Save it. 

That's pretty much the configuration that We need on the SNOW side. 

Now we need to install the app on Splunk like any other app. 

1. Restart Splunk after installing the app. 
2. Go to the app 
3. Put the URL for your Snow instance the user that you created on Snow and his password and save the configuration. 
   • If you don't get any error message during this process it means that the connection was successful. 
4. Go to apps and look for SNOW 
5. Click on "view objects" 

You will see that some of the searches are not enabled. Enable the one you need. 

And check if it works: 

1. Go to the Snow App. 
2. On "Actions" you should see the "servicenow incident integration" tab. 

The user must have read and write permissions on the app.

We could log an incident as administrator on Snow using this query:
 

|snowincident --category "Network" --short_description "testing search" --contact_type 
"email" --urgency "3" --subcategory "intranet" --state "1" --location "Hawaii" --impact "2"
 --priority "5" --assignment_group "network" --opened_by "ME" --ci_identifier "1234567" 
--comments "these are Don's comments" --splunk_url "www.splunk.com" --correlation_id "123abc"

But we couldn't generate it using another user.

We were getting this error message on snow_ta_ticket.log: 

 

2019-07-30 20:00:01,597 ERROR pid=24194 tid=MainThread file=snow_ticket.py:_get_service_now_
account:158 | username=<encrypted>, password=<encrypted>, url=https://something.com 
2019-07-30 20:00:01,618 ERROR pid=24194 tid=MainThread file=snow_ticket.py:_get_service_now_
account:162 | url=https://something.com, app=Splunk_TA_snow 
2019-07-30 20:00:01,618 ERROR pid=24194 tid=MainThread file=snow_ticket.py:_get_service_now_
account:165 | Failed to get clear credentials for https://something.com

Resolution

So we added this capability to the user role:

list_storage_passwords

After doing that the user was able to create incidents on SNOW.

We tested it with this query:
 

index=servicenow_eo sourcetype="snow:incident" "Splunk provided the following enrichment 
information" | table number, short_description, dv_state, dv_cmdb_ci, dv_assignment_group
dv_opened_at | sort dv_state

 

Revision History

Revision	Publish Date	Comments
1.0	28-Sep-2026	Initial Release