How to integrate Splunk with ServiceNow to create Incident?

[schiwark]

I want to integrate Splunk with ServiceNow where incident should get created for every alert triggered in Splunk. Can someone suggest steps to achieve this?

[Nisha18789]

hi @schiwark , you can either use splunk addon for SNow : https://splunkbase.splunk.com/app/1928/

or,  you can leverage autotrigger feature in Service Now, where if you send an email from Splunk with a specified format to a configured Service Now email, Service Now will be able to raise an incident with the details sent in the email. see : https://community.servicenow.com/community?id=community_question&sys_id=2fcb07e1db9cdbc01dcaf3231f96...

[schiwark]

Thanks @Nisha18789 

How can I achieve this by using add on. Will installing SNOW add on in Splunk enterprise will suffice or do I need to perform some extra configurations as well?

[Nisha18789]

Hi @schiwark , using the addon will also require some settings on Service Now to integrate with Splunk, as this option provides not only creating/updating incidents but you will be able to get incident data from Service Now in Splunk.

You can refer below link for the details on set up required on Service Now side.

https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/ConfigureServiceNowtointegratewithS...

For a complete guide, please refer :

https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/About

Hope this helps.