We have this stood up and working...sort of. Splunk Admins can configure alerts to add the "ServiceNow Incident Integration" action, and we can create Incidents in Splunk.
The problem is, we have a lot of development teams that create/maintain their own alerts in Splunk. When they go to add this action, they're not able to select the account to use when configuring the action...because they don't have read permission to the account. Even if an Admin goes in and configures the action, it won't work at run-time, because the alert runs under the owner's permissions...which can't read the credentials to use to call ServiceNow.
Has anyone else ran into this issue? How can this be setup to allow non-Admins to maintain alerts?
