All Apps and Add-ons

Manual search commands


I am using version 1.22 of the ServiceNow Security Operations app on Splunk 6.5.3. I want to use the snsecincident command in a search in order to customize some of the incident properties that can't be customized within the Create ServiceNow Security Incident Alert Action. Then I want to schedule that search as an Splunk Alert. However when I attempt to use either of the snsecevent or snsecincident manual search commands, I get the error This command must be the first command of a search.

Am I misunderstanding the documentation? Shouldn't I be able to pass the fields from a search to these commands?

0 Karma


Reference documentation available at

The command needs to be at the beginning of your search, preceded by a pipe character. E.g.
| snsecevent node TESTnode type TESTtype resource TESTresource

You can see the workflow action in Splunk under Fields -> Workflow actions, which shows the equivalent search using placeholders.

Are you able to use the | snowevent or | snowincident commands in the ServiceNow add-on?

Finally, if you have access, you could try script execution of the TA_ServiceNow_SecOps/bin/ per the commands.conf mapping.
The relevant parameters are passed into a datamap[] and then to the SNOW REST API

NB: maps to the actions specified in the alert_actions.conf file, which aligns with the GUI fields in the Security Operations Integration add-on. Hope that helps.

0 Karma

New Member

scottprigge - I hope this is not a 'DenverCoder9' type thing (, but did you ever resolve this? I'm trying to do the same thing and am getting the same error you described.

0 Karma


Sorry, I never got to the bottom of this. I am limited to customizing the fields of the the custom alert actions that are built into the app. I don't recall what specific things I wanted to customize at the time I posted it.

0 Karma