Alerting

ServierNow ticket custom fields options/tokens

cbiraris
Path Finder

Hi Team,

I have a active Servcenow ticket and email notification integration setup already for splunk alerts. 
I am trying to add tokens which show me query result in serviceNow ticket description as same as we are getting in email notification when we check  Inline Table fields.

can you help me to add same in serviceNow ticket as well. so that I can get query result in ticket as well. right now its showing me only title of the alerts. due to which I need to go to splunk every time when alert trigger  and need to run alerts search to validate alerts manually.

 

 

 

Labels (1)
0 Karma

mjones1
Engager

I'm more familiar with the ServiceNow side of things, but in the alert action, there's a Custom Fields section.  You can add additional fields there, eg

description=[whatever info you want to pass from Splunk]

On the ServiceNow side, you'll have to tweak the Transform Map to map the Description field over from the import set table that incidents are originally created on, to the actual Incident table in ServiceNow.  I don't know why description isn't included OOTB, seems like a pretty useful field to populate...

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...