All Apps and Add-ons

Splunk add-on for ServiceNow - How to send csv results from alert action?

New Member

I would either like to send the results table as the description field to ServiceNow or be able to pass the csv results and attach it to the opened incident ticket.
The goal is to work the ticket from ServiceNow without having to go into Splunk to review the results.

As of now in the description field i am passing
$result.src_ip$ $result.dest_ip$ $result.threat_intel_list$ $result.threat_match_field$ $result.threat_collection$ $result.original_sourcetype$ $result.count$
but the only passes the first result of the report.

Has anyone be able to pass the all the search results into a single ServiceNow ticket?

Labels (1)
0 Karma


have you got any solution for this? I am willing to attach the csv of the results to be attached in the SNOW ticket. That would be really great.

0 Karma


I am also working on case like this. How ever I found a way to do the same using existing integration.  You can use the | stats to output all the results in one column. It will be messy for sure. Also in Service now ticket there is a character limit to all the fields like description , short description. you have to keep that in mind too before setting up alert like this.

| stats values(fieldname) by some field


Tags (1)
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...