Hi all,
I was wondering what are the steps involved in developing a splunk alert that creates an incident ticket on Service Now - this ticket would be updated if further alerts are triggered by the same folder/account.
E.g.
Splunk alert is triggered an incident ticket is created.
The same splunk alert is triggered for the same person/folder/entity instead of creating a new incident ticket it appends onto the one created and open
I've found some doc's on integrating Splunk and Snow together. But in regards to establishing the alert side of things the documentation to do so seems out dated; "Scripted Alert is now a deprecated Splunk feature. The best practice is to use custom alert actions instead." If thats the case how should I implement the splunk alert?
