All Apps and Add-ons

Splunk integration with ServiceNow case management?

ravitejat
New Member

I have integrated Splunk with Service Now using Add on. Now I have 2 questions:

  1. I'm able to bring the desired cases data into Splunk. I'm only able to create but cannot delete the record in Splunk when I delete the same case in Service now , so what should I do?
  2. When trying to push the data to ServiceNow from Splunk, I'm able to push the data to only incident and event table, but not my desired table. Is there a way to do that?
0 Karma

rjv
New Member

For point 2, yes , if from UI like alert configuration screen, mention the ServiceNow table name in the 'endpoint' . if from a custom search, along with minimum parameters Account and Correlation_ID , add 'scripted_endpoint' , e.g.  | eval scripted_endpoint="/api/now/table/xxxxxx" 
Refer Splunk documentation: Commands, alert actions, and scripts - Splunk Add-on for ServiceNow

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...