Troubleshooting ServiceNow Connector Query Parameter Discrepancies

Applicability

Description

Discrepancies in data retrieval may occur when utilizing different versions of the ServiceNow connector within the same infrastructure. Some connector versions automatically append the sysparm_query parameter to requests, while others require explicit parameter definition. This inconsistency can lead to an "invalid input parameter" error if the query syntax is not adjusted for the specific connector version installed.

Investigation

Observe the results of the "Run Query" action in the ServiceNow connector.

1. Identify the version of the ServiceNow connector installed in the environment via the Apps page.
2. If version 2.6.8 is in use, it automatically appends the sysparm_query prefix to the query string.
3. If version 2.6.10 is in use, the logic processes query parameters differently, often requiring the full parameter string to be defined by the user without automated prefixing.
4. If an "invalid input parameter" error is returned, test the query by removing the redundant prefix if the environment is strictly enforcing parameter schema.

Resolution

To ensure consistent functionality across development, staging, and production environments:

1. Version Parity: Maintain the same version of the ServiceNow connector across all environments to ensure predictable behavior.
2. Syntax Adjustment: If versioning must differ between environments, modify the query string based on the specific version:
   • For versions that automatically append sysparm_query, use: active=true
   • For versions requiring explicit declaration, use: sysparm_query=active=true
3. Verification: After adjusting the query parameters or downgrading/upgrading the connector app via the Splunk SOAR Apps interface, re-run the action to verify successful execution.

Related Links

N/A