How to create a alert action for service now with email?

[knalla]

Hi,

I'm trying to create a alert action to send email to SNOW instance to create a incident. Whats the best way to achieve it?

[Sukisen1981]

Look at this - https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Usescriptedalerts
or this
https://splunkbase.splunk.com/app/1770/

[knalla]

Thanks Susiken, but we are on London version, current add-on is not compatible with it.

[Sukisen1981]

there is another way of course, you can use REST API modular inputs and use that to populate the incident creation table in service now.
For this you need access to snow as a REST API , that is service now should allow your service to access it. Is that possible?

[knalla]

Yes, we can get read-only access to API.

[Sukisen1981]

well then, try these steps out
1- https://splunkbase.splunk.com/app/1546/ install the app
2- Pass the required credentials in a POST method using the REST API modular input app.
Try it out, it is very difficult to give a solutions without knowing the required fields for your api access/auth tokens etc. but this app is simple and easy to use.