All Apps and Add-ons

Custom Fields handling in Splunk Add-on for ServiceNow

tcdbruijn
Engager

Hi fellow Splunkers,

I have some questions regarding using custom fields in the Splunk Add-on for ServiceNow.

When I try to set an alert to resolved (state 6) I seem to be unable to set the resolution information or resolution notes, instead I now place it as a comment. Did someone here manage to arrange this?

Upon creating a ticket in SNOW I can set the "short_description" field but I seem to be unable to set the "description" field. As in we can set the description field in Splunk but the content won’t be shown in SNOW, also when i set it as a custom field. Perhaps some mapping/configuration on SNOW side is needed here, but there is no documentation about what needs to be done on SNOW side.

So I guess my questions are related to how to make custom fields working on both Splunk and SNOW side as I’m missing some documentation and need some guidance! Would be much appreciated if someone can help  out!

Labels (4)
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...