if I close one of the incident in Servicenow, for a host if alert triggers again. Will it create a new ticket or update the previous one with the same corelation id?

[sag5757]

When an Alert_XYZ alert triggers and create new service now incident with correlation id like "Alert_XYZ:$result.host$", someone works on that ticket in Service Now and closes it. If the same alert (Alert_XYZ ) triggers for the same host again on next day. Does it open a closed incident and update it ? OR It will open a new incident with the same correlation id(Alert_XYZ:$result.host$).

I have a scenario which i have to implement : When an alert triggers in Service now through custom alert actions it should create an incident in servicenow . Till the time incident is not closed in servicenow same incident should be updated everytime if same alert triggers. But if the incident is closed in Servicenow then Splunk should create a new incident with new correlation ID.

[Dharmesh_93]

@sag5757 

The following steps ensure a unique correlation ID is created every time a new alert is triggered:

1) Append this query into the search portion of the alert action:

| eval unique_id= random() + now()

2) After that, navigate to Alert Action > Correlation ID > and put this for the value:

$result.unique_id$
3) Save the Alert Action.

By having a new, unique Correlation ID each time, a new incident should be created.

If you want to update the same incident, then make sure that the correlation ID which you are passing from Splunk should be same as ServiceNow ticket update works mainly with the correlation ID

[sag5757]

@ansif Rahman and @KamleshVaghela. Hi ,Can you please provide any solution for this. i am not able understand how this correlation ID is working while doing Servicenow Integration.Please help