I have integrated Splunk with Service Now using Add on. Now I have 2 questions:
For point 2, yes , if from UI like alert configuration screen, mention the ServiceNow table name in the 'endpoint' . if from a custom search, along with minimum parameters Account and Correlation_ID , add 'scripted_endpoint' , e.g. | eval scripted_endpoint="/api/now/table/xxxxxx"
Refer Splunk documentation: Commands, alert actions, and scripts - Splunk Add-on for ServiceNow