All Apps and Add-ons

How to integrate Splunk with ServiceNow to create Incident?

schiwark
Explorer

I want to integrate Splunk with ServiceNow where incident should get created for every alert triggered in Splunk. Can someone suggest steps to achieve this?

Labels (1)
0 Karma

Nisha18789
Builder

hi @schiwark , you can either use splunk addon for SNow : https://splunkbase.splunk.com/app/1928/

or,  you can leverage autotrigger feature in Service Now, where if you send an email from Splunk with a specified format to a configured Service Now email, Service Now will be able to raise an incident with the details sent in the email. see : https://community.servicenow.com/community?id=community_question&sys_id=2fcb07e1db9cdbc01dcaf3231f96...

schiwark
Explorer

Thanks @Nisha18789 

How can I achieve this by using add on. Will installing SNOW add on in Splunk enterprise will suffice or do I need to perform some extra configurations as well?

0 Karma

Nisha18789
Builder

Hi @schiwark , using the addon will also require some settings on Service Now to integrate with Splunk, as this option provides not only creating/updating incidents but you will be able to get incident data from Service Now in Splunk.

You can refer below link for the details on set up required on Service Now side.

https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/ConfigureServiceNowtointegratewithS...

For a complete guide, please refer :

https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/About

Hope this helps.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...