if I close one of the incident in Servicenow, for a host if alert triggers again. Will it create a new ticket or update the previous one with the same corelation id?


When an Alert_XYZ alert triggers and create new service now incident with correlation id like "Alert_XYZ:$$", someone works on that ticket in Service Now and closes it. If the same alert (Alert_XYZ ) triggers for the same host again on next day. Does it open a closed incident and update it ? OR It will open a new incident with the same correlation id(Alert_XYZ:$$).

I have a scenario which i have to implement : When an alert triggers in Service now through custom alert actions it should create an incident in servicenow . Till the time incident is not closed in servicenow same incident should be updated everytime if same alert triggers. But if the incident is closed in Servicenow then Splunk should create a new incident with new correlation ID.

Labels (1)
0 Karma

Loves-to-Learn Lots


The following steps ensure a unique correlation ID is created every time a new alert is triggered:

1) Append this query into the search portion of the alert action:

| eval unique_id= random() + now()

2) After that, navigate to Alert Action > Correlation ID > and put this for the value:

3) Save the Alert Action.

By having a new, unique Correlation ID each time, a new incident should be created.

If you want to update the same incident, then make sure that the correlation ID which you are passing from Splunk should be same as ServiceNow ticket update works mainly with the correlation ID

0 Karma


@ansif Rahman and @KamleshVaghela. Hi ,Can you please provide any solution for this. i am not able understand how this correlation ID is working while doing Servicenow Integration.Please help

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...