SPlunk ServiceNow integration

[apurvasharma201]

Hi Team,

We are doing ServiceNow integration , as per the steps we have a test Splunk enterprise account and downloaded the Splunkbase ServiceNow app.
In Seraches,Alert we have created a alert to create an incident, when we run this nothing happen, it runs but doesn't create incident

[ivanreis]

Please check the troubleshoot steps -> https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Troubleshooting#Find_relevant_error...

search for errors on eventtype=snow_ticket_error.

verify if all those steps here are completed -> https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/ConfigureServiceNowtointegratewithS...

check this link to manually create incidents without wait for schedule alert to be triggered
https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Commandsandscripts#Usage

In order to create incidents, the account you setup at service now, has rights to create the incident direct on the incidents table or if you are using service now events to appropriate assign ticket to the correct team to work on, you have to use the events feature at servicenow, and you can use the | snowevent ... command to test it.

In the ServiceNow add-on, you have to setup a proxy server to connect with servicenow server, it can be a potential issue for you not able to connect to server and also create incidents.
https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Setuptheadd-on