https://community.splunk.com/t5/Getting-Data-In/Alert-to-create-NEW-ServiceNow-Incident/m-p/540870#M90532 <P>Hello All,</P><P>I have an alert that has an Action to create a SNow Incident when a file has not been received by a certain date.</P><P>The first time the alert ran and the action was triggered, a new Incident was created.&nbsp; Subsequently, the original Incident has been reopened.&nbsp; This is not what I want.&nbsp; I need to have a new Incident for each time the action is triggered.</P><P>I have tried setting 'state' to 1, which implies New in the documentation here -&nbsp;<A href="https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Commandsandscripts" target="_blank" rel="noopener">https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Commandsandscripts</A></P><TABLE><TBODY><TR><TD>state</TD><TD>No</TD><TD>Number</TD><TD>4</TD><TD>The state of the incident. For example:<BR /><P><STRONG>1 - New</STRONG><BR />2 - Active<BR />3 - Awaiting Problem<BR />4 - Awaiting User Info<BR />5 - Awaiting Evidence<BR />6 - Resolved<BR />7 - Closed</P></TD></TR></TBODY></TABLE><P>I have also left the Correlation ID blank so that a new (unique) ID is created.</P><TABLE><TBODY><TR><TD>Correlation ID</TD><TD>A unique ID to support third-party application integration. It should only consist of alphanumeric characters, underscore (_), and hyphen (-) in its value. Leave blank for the Splunk Add-on for ServiceNow to generate a unique ID for you.</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>Thanks in advance for support</P> Mon, 22 Feb 2021 16:51:46 GMT timrich66 2021-02-22T16:51:46Z https://community.splunk.com/t5/Getting-Data-In/Alert-to-create-NEW-ServiceNow-Incident/m-p/540870#M90532 <P>Hello All,</P><P>I have an alert that has an Action to create a SNow Incident when a file has not been received by a certain date.</P><P>The first time the alert ran and the action was triggered, a new Incident was created.&nbsp; Subsequently, the original Incident has been reopened.&nbsp; This is not what I want.&nbsp; I need to have a new Incident for each time the action is triggered.</P><P>I have tried setting 'state' to 1, which implies New in the documentation here -&nbsp;<A href="https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Commandsandscripts" target="_blank" rel="noopener">https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Commandsandscripts</A></P><TABLE><TBODY><TR><TD>state</TD><TD>No</TD><TD>Number</TD><TD>4</TD><TD>The state of the incident. For example:<BR /><P><STRONG>1 - New</STRONG><BR />2 - Active<BR />3 - Awaiting Problem<BR />4 - Awaiting User Info<BR />5 - Awaiting Evidence<BR />6 - Resolved<BR />7 - Closed</P></TD></TR></TBODY></TABLE><P>I have also left the Correlation ID blank so that a new (unique) ID is created.</P><TABLE><TBODY><TR><TD>Correlation ID</TD><TD>A unique ID to support third-party application integration. It should only consist of alphanumeric characters, underscore (_), and hyphen (-) in its value. Leave blank for the Splunk Add-on for ServiceNow to generate a unique ID for you.</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>Thanks in advance for support</P> Mon, 22 Feb 2021 16:51:46 GMT https://community.splunk.com/t5/Getting-Data-In/Alert-to-create-NEW-ServiceNow-Incident/m-p/540870#M90532 timrich66 2021-02-22T16:51:46Z