ServierNow ticket custom fields options/tokens

[cbiraris]

Hi Team,

I have a active Servcenow ticket and email notification integration setup already for splunk alerts. 
I am trying to add tokens which show me query result in serviceNow ticket description as same as we are getting in email notification when we check  Inline Table fields.

can you help me to add same in serviceNow ticket as well. so that I can get query result in ticket as well. right now its showing me only title of the alerts. due to which I need to go to splunk every time when alert trigger  and need to run alerts search to validate alerts manually.

[mjones1]

I'm more familiar with the ServiceNow side of things, but in the alert action, there's a Custom Fields section.  You can add additional fields there, eg

description=[whatever info you want to pass from Splunk]

On the ServiceNow side, you'll have to tweak the Transform Map to map the Description field over from the import set table that incidents are originally created on, to the actual Incident table in ServiceNow.  I don't know why description isn't included OOTB, seems like a pretty useful field to populate...