All Apps and Add-ons

How to setup a Splunk alert that will create/update an Incident ticket in ServiceNow

New Member

Hi all,

I was wondering what are the steps involved in developing a splunk alert that creates an incident ticket on Service Now - this ticket would be updated if further alerts are triggered by the same folder/account.


Splunk alert is triggered an incident ticket is created.

The same splunk alert is triggered for the same person/folder/entity instead of creating a new incident ticket it appends onto the one created and open


I've found some doc's on integrating Splunk and Snow together. But in regards to establishing the alert side of things the documentation to do so seems out dated; "Scripted Alert is now a deprecated Splunk feature. The best practice is to use custom alert actions instead."  If thats the case how should I implement the splunk alert? 

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...