When an Alert_XYZ alert triggers and create new service now incident with correlation id like "Alert_XYZ:$result.host$", someone works on that ticket in Service Now and closes it. If the same alert (Alert_XYZ ) triggers for the same host again on next day. Does it open a closed incident and update it ? OR It will open a new incident with the same correlation id(Alert_XYZ:$result.host$).
I have a scenario which i have to implement : When an alert triggers in Service now through custom alert actions it should create an incident in servicenow . Till the time incident is not closed in servicenow same incident should be updated everytime if same alert triggers. But if the incident is closed in Servicenow then Splunk should create a new incident with new correlation ID.