Splunk App and Add-on for ServiceNow: Can Splunk track the change history of a ServiceNow incident?

[vaneev]

Currently we are using Service Now for incident tracking at my organization.
Recently, my department purchased a Splunk license.
I am not an admin in Splunk, just researching the possibility of integrating Splunk with Service Now.

Specifically, I am interested in Advanced Reporting.
My team would like to be able to have Splunk pull Service Now Incident information, and then create reports to analyze the team's performance. Specifically, we would like to build a "touched by report" that tracks incoming and outgoing tickets. We want this report based on assignment groups, by assignee (person who is resolving the ticket), and by person's interaction (any user who has in any way change or logged a comment on the ticket).
- Incoming tickets would be incidents that are created in a certain groups queue (in service now) or open tickets transferred into a groups queue (in service now)
- Outgoing tickets would be incidents that are cancelled, resolved by a certain groups queue (in service now) or open tickets transferred into a different groups queue (in service now)

Basically, my question is this, can Splunk track the change history of a Service Now Incident? Does it create an event each time the Incident is changed?

Also what apps / add-ons are needed? Are both of these needed?
-Splunk Add-on for ServiceNow
-Splunk App for ServiceNow

[ehaddad_splunk]

Short answer is "Yes". Every time an incident is updated in SNOW, a new entry in the incident table is created with the sys_update_time updated. Splunk ingest these entries/records as separate events using the add-on. Once these events are in Splunk, you can do pretty much whatever you want. You can track changes or dedup by sys_id to get the latest on that incident