Alerting

ServierNow ticket custom fields options/tokens

cbiraris
Path Finder

Hi Team,

I have a active Servcenow ticket and email notification integration setup already for splunk alerts. 
I am trying to add tokens which show me query result in serviceNow ticket description as same as we are getting in email notification when we check  Inline Table fields.

can you help me to add same in serviceNow ticket as well. so that I can get query result in ticket as well. right now its showing me only title of the alerts. due to which I need to go to splunk every time when alert trigger  and need to run alerts search to validate alerts manually.

 

 

 

Labels (1)
0 Karma

mjones1
New Member

I'm more familiar with the ServiceNow side of things, but in the alert action, there's a Custom Fields section.  You can add additional fields there, eg

description=[whatever info you want to pass from Splunk]

On the ServiceNow side, you'll have to tweak the Transform Map to map the Description field over from the import set table that incidents are originally created on, to the actual Incident table in ServiceNow.  I don't know why description isn't included OOTB, seems like a pretty useful field to populate...

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...