Splunk Addon for Service Now-dump out all ServiceNow addon setup for each alert

[Cheng2Ready]

Splunk is there a way to dump out all ServiceNow add on setup for each/all alert?
trying to grab all alerts that has this action
and put in a table with all the setup it has :
state, CI, contact  type, assignment group ,....ect

Cheng2Ready_1-1738776279789.pngCheng2Ready_2-1738776289656.png

[luizlimapg · Accepted solution]

Hi @Cheng2Ready 

You can use REST for that, like in this example:

| rest /servicesNS/-/-/saved/searches splunk_server=local
| search action.snow_incident=1
| table title, disabled, action.snow_incident.param.assignment_group, action.snow_incident.param.contact_type

The fields related to the alert actions in ServiceNow follow the pattern action.snow_event* or action.snow_incident*