topic Re: Splunk Alerts generated through Service now incident.. in Deployment Architecture

Splunk Alerts generated through Service now incident..

vijreddy30 — Mon, 25 Dec 2023 08:28:52 GMT

Hi Team,

In my requirement, if any splunk servers are got failed, need to be generated Services now incidents need to be created automatically...

How do we write the query and how do we configure Service now incidents, please help me

Re: Splunk Alerts generated through Service now incident..

marnall — Mon, 25 Dec 2023 23:12:38 GMT

You would probably find the splunk Add-on for ServiceNow useful: https://splunkbase.splunk.com/app/1928

As for the query, you could compare the list of splunk server names active now versus the servers active a few days ago. e.g.

index=_internal host="*splunknamescheme*" OR host IN (splunkserver1, splunkserver2) earliest=-3d latest=-2d | dedup host | table host | search NOT [search index=_internal host="*splunknamescheme*" OR host IN (splunkserver1, splunkserver2) earliest=-1d | dedup host | table host]

Then you can add an Alert Action to the alert and make it create an incident: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Usecustomalertactions

Re: Splunk Alerts generated through Service now incident..

vijreddy30 — Wed, 27 Dec 2023 08:21:14 GMT

Hi Team,

I am trying to below query, it showing the all servers are up, I tested one server stopped and checked it's not showing Down status, please fine the below query

Please letme know exact query on that.