Splunk Addon for Service Now-dump out all ServiceNow addon setup for each alert

[Cheng2Ready]

Splunk is there a way to dump out all ServiceNow add on setup for each/all alert?
trying to grab all alerts that has this action
and put in a table with all the setup it has :
state, CI, contact  type, assignment group ,....ect

[luizlimapg · Accepted solution]

Hi @Cheng2Ready 

You can use REST for that, like in this example:

| rest /servicesNS/-/-/saved/searches splunk_server=local
| search action.snow_incident=1
| table title, disabled, action.snow_incident.param.assignment_group, action.snow_incident.param.contact_type

The fields related to the alert actions in ServiceNow follow the pattern action.snow_event* or action.snow_incident*