https://community.splunk.com/t5/Splunk-ITSI/Splunk-ITSI-and-ServiceNow-Auto-populate-fields/m-p/376081#M522 <P>have you tried to use $result.orig_description$. That format was used for other alerting methods.</P> Wed, 16 Jan 2019 17:57:10 GMT MVREID 2019-01-16T17:57:10Z https://community.splunk.com/t5/Splunk-ITSI/Splunk-ITSI-and-ServiceNow-Auto-populate-fields/m-p/376079#M520 <P>Hi, I have installed and configured the Add-on for ServiceNow. Integration with notable events are working, incidents are created in Service Now. But I would like to have the fields auto populated from the notable event. See screenshot.</P> <P>Is it possible to have a two-way communication? close the Notable Event when ServiceNow ticket is closed i.e.</P> <P>Any tip?<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5178i5C5237BF418A8506/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 07 Jun 2018 10:49:39 GMT https://community.splunk.com/t5/Splunk-ITSI/Splunk-ITSI-and-ServiceNow-Auto-populate-fields/m-p/376079#M520 taskar 2018-06-07T10:49:39Z https://community.splunk.com/t5/Splunk-ITSI/Splunk-ITSI-and-ServiceNow-Auto-populate-fields/m-p/376080#M521 <P>Splunk_TA_snow/local/local/alert_actions.conf is the config file for populating the fields. But havent found any way to use use token variables such as %orig_description%, %orig_owner%, %orig_severity%, %orig_status%, and so on.</P> Tue, 29 Sep 2020 21:45:50 GMT https://community.splunk.com/t5/Splunk-ITSI/Splunk-ITSI-and-ServiceNow-Auto-populate-fields/m-p/376080#M521 taskar 2020-09-29T21:45:50Z https://community.splunk.com/t5/Splunk-ITSI/Splunk-ITSI-and-ServiceNow-Auto-populate-fields/m-p/376081#M522 <P>have you tried to use $result.orig_description$. That format was used for other alerting methods.</P> Wed, 16 Jan 2019 17:57:10 GMT https://community.splunk.com/t5/Splunk-ITSI/Splunk-ITSI-and-ServiceNow-Auto-populate-fields/m-p/376081#M522 MVREID 2019-01-16T17:57:10Z https://community.splunk.com/t5/Splunk-ITSI/Splunk-ITSI-and-ServiceNow-Auto-populate-fields/m-p/376082#M523 <P>thanks for your reply. I've tried what you suggest - dont work any better. A workaround is to use Alerts instead of the ServiceNow integration in ITSI. Then tokens are working as expected. Rumors as it that a new integration with servicenow is coming Q1 2019. Fingers crossed</P> Thu, 17 Jan 2019 07:39:04 GMT https://community.splunk.com/t5/Splunk-ITSI/Splunk-ITSI-and-ServiceNow-Auto-populate-fields/m-p/376082#M523 taskar 2019-01-17T07:39:04Z https://community.splunk.com/t5/Splunk-ITSI/Splunk-ITSI-and-ServiceNow-Auto-populate-fields/m-p/376083#M524 <P>Could not run the action. Status: 500 (Internal Server Error) Details: Splunkd daemon is not responding: ("Error connecting to /servicesNS/nobody/-/service_now_incident/snow_incident: ('The read operation timed out',)",)</P> <P>I'm getting this error, After Clicking Done on the same above screenshot</P> Tue, 29 Sep 2020 23:32:40 GMT https://community.splunk.com/t5/Splunk-ITSI/Splunk-ITSI-and-ServiceNow-Auto-populate-fields/m-p/376083#M524 AnilPujar 2020-09-29T23:32:40Z