Can I create dynamic descriptions in Splunk for auto generated tickets in Service Now?

[saibal6]

Hi Experts,

My errors are dynamic and I want to create auto generated tickets in Service Now which has the dynamic description based on my dynamic errors. Can I do this in Splunk?

I'm working only in Splunk instance. The Service Now part has been done from other team even the Splunk add on Service Now tool has been done by the same team.

So I want to know that what I have to do in my Splunk instance so that Service Now can get that dynamic descriptions to create a ticket.

Notes: [If there any documents are available for the Splunk instance please share the link.]

[ppablo]

Hi @saibal6

Did the answer below work for you? If yes, please resolve your post by clicking "Accept" directly below the answer. If not, please comment with any issues you are still seeing.

Thanks!

[saibal6]

Hi @ppablo,

Now I'm using Splunk Enterprise Free license. So now I can't able to check the below mentioned solution because you know that in free license mode we can't check the alert/report part in Splunk. Within few days we will purchase the Splunk Enterprise license, after that I can check with the below solution and let you know where it is properly working or not.

Thanks for your patience 🙂 !

[ppablo]

Hi @saibal6

I totally understand, no problem. Thank you for your following up with your comment and update 🙂

[Azeemering]

Yes you can:

http://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Commandsandscripts

For example, if you enter the following generating search:

| snowevent --node "localhost" --resource "CPU" --type "Virtual Machine"
--severity 1 --additional_info "https://localhost:8000"
--description "Something bad happened"
ServiceNow automatically creates an incident with the following parameters:

Splunk Drilldown URL: https://localhost:8000
Correlation ID: Generated randomly
Short description: Virtual Machine: localhost (CPU) - Something bad happened
Category: Inquiry/help
Contact type: Phone

[saibal6]

Hi @Azeemering,

Now I'm using Splunk Enterprise Free license. So now I can't able to check the below mentioned solution because you know that in free license mode we can't check the alert/report part in Splunk. Within few days we will purchase the Splunk Enterprise license, after that I can check with the below solution and let you know where it is properly working or not.

Thanks for your patience 🙂 !