Splunk add-on for ServiceNow - How to send csv results from alert action?

[jformosa]

I would either like to send the results table as the description field to ServiceNow or be able to pass the csv results and attach it to the opened incident ticket.
The goal is to work the ticket from ServiceNow without having to go into Splunk to review the results.

As of now in the description field i am passing
$result.src_ip$ $result.dest_ip$ $result.threat_intel_list$ $result.threat_match_field$ $result.threat_collection$ $result.original_sourcetype$ $result.count$
but the only passes the first result of the report.

Has anyone be able to pass the all the search results into a single ServiceNow ticket?

[joga]

have you got any solution for this? I am willing to attach the csv of the results to be attached in the SNOW ticket. That would be really great.

[joga]

I am also working on case like this. How ever I found a way to do the same using existing integration.  You can use the | stats to output all the results in one column. It will be messy for sure. Also in Service now ticket there is a character limit to all the fields like description , short description. you have to keep that in mind too before setting up alert like this.

| stats values(fieldname) by some field