I am unable to see the incident logs in service now which are under sourcetype=snow:incident . I am able to see all other sourcetypes like snow:cmdb , snow:em_event , snow:sys_user_list ,snow:problem etc but not the incident data .I checked the internal logs and I see the below error
2019-09-26 14:45:28,749 ERROR pid=39335 tid=Thread-1 file=snow_data_loader.py:_do_collect:168 | Failed to connect https://lxxxuw.service-now.com/api/now/table/sysevent?sysparm_display_value=all&sysparm_limit=1000&sysparm_exclude_reference_link=true&sysparm_query=sys_created_on>=2018-09-26+18:45:25^ORDERBYsys_created_on, reason=Forbidden
2019-09-26 14:49:00,753 ERROR pid=116355 tid=Thread-16 file=snow_data_loader.py:collect_data:137 | Failed to get records from https://luxxuw.service-now.com/cmdb_rel_ci
2019-09-26 14:48:59,895 ERROR pid=36342 tid=Thread-13 file=thread_pool.py:_run:259 | Traceback (most recent call last):
File "/apps/splunk/etc/apps/Splunk_TA_snow/bin/framework/thread_pool.py", line 257, in _run
func()
File "/apps/splunk/etc/apps/Splunk_TA_snow/bin/snow_job_factory.py", line 38, in __call__
sc.DEFAULT_RECORD_LIMIT))
File "/apps/splunk/etc/apps/Splunk_TA_snow/bin/snow_data_loader.py", line 126, in collect_data
jobjs = self._json_to_objects(content)
File "/apps/splunk/etc/apps/Splunk_TA_snow/bin/snow_data_loader.py", line 177, in _json_to_objects
return json.loads(json_str)
File "/opt/splunk/lib/python2.7/json/__init__.py", line 339, in loads
return _default_decoder.decode(s)
File "/opt/splunk/lib/python2.7/json/decoder.py", line 364, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
File "/opt/splunk/lib/python2.7/json/decoder.py", line 380, in raw_decode
obj, end = self.scan_once(s, idx)
ValueError: Expecting : delimiter: line 1 column 4396952 (char 4396951
What changes should i make .Please suggest and thanks in advance
↧