Splunk Alerts generated through Service now incident..

[vijreddy30]

Hi Team,

In my requirement, if any splunk servers are got failed, need to be generated Services now incidents need to be created automatically...

How do we write the query and how do we configure Service now incidents, please help me 

[vijreddy30]

Hi Team,

I am trying to below query, it showing the all servers are up, I tested one server stopped and checked  it's not showing Down status, please fine the below query

index="_internal"
| eval host=lower(host)
| stats count BY host
| append [ | eval host=lower(host) ]
| eval status=if(total=0,"Down","up")
| table host status

Please letme know exact query on that.

[marnall]

You would probably find the splunk Add-on for ServiceNow useful: https://splunkbase.splunk.com/app/1928

As for the query, you could compare the list of splunk server names active now versus the servers active a few days ago. e.g.

index=_internal host="*splunknamescheme*" OR host IN (splunkserver1, splunkserver2) earliest=-3d latest=-2d 
| dedup host 
| table host
| search NOT [search index=_internal host="*splunknamescheme*" OR host IN (splunkserver1, splunkserver2) earliest=-1d
| dedup host 
| table host]

 Then you can add an Alert Action to the alert and make it create an incident: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Usecustomalertactions