Alerting

if I close one of the incident in Servicenow, for a host if alert triggers again. Will it create a new ticket or update the previous one with the same corelation id?

sag5757
Explorer

When an Alert_XYZ alert triggers and create new service now incident with correlation id like "Alert_XYZ:$result.host$", someone works on that ticket in Service Now and closes it. If the same alert (Alert_XYZ ) triggers for the same host again on next day. Does it open a closed incident and update it ? OR It will open a new incident with the same correlation id(Alert_XYZ:$result.host$).

I have a scenario which i have to implement : When an alert triggers in Service now through custom alert actions it should create an incident in servicenow . Till the time incident is not closed in servicenow same incident should be updated everytime if same alert triggers. But if the incident is closed in Servicenow then Splunk should create a new incident with new correlation ID.

Labels (1)
0 Karma

sag5757
Explorer

@ansif Rahman and @KamleshVaghela. Hi ,Can you please provide any solution for this. i am not able understand how this correlation ID is working while doing Servicenow Integration.Please help

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.