Hello All,
I have an alert that has an Action to create a SNow Incident when a file has not been received by a certain date.
The first time the alert ran and the action was triggered, a new Incident was created. Subsequently, the original Incident has been reopened. This is not what I want. I need to have a new Incident for each time the action is triggered.
I have tried setting 'state' to 1, which implies New in the documentation here - https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Commandsandscripts
| state | No | Number | 4 | The state of the incident. For example:
1 - New
2 - Active
3 - Awaiting Problem
4 - Awaiting User Info
5 - Awaiting Evidence
6 - Resolved
7 - Closed |
I have also left the Correlation ID blank so that a new (unique) ID is created.
| Correlation ID | A unique ID to support third-party application integration. It should only consist of alphanumeric characters, underscore (_), and hyphen (-) in its value. Leave blank for the Splunk Add-on for ServiceNow to generate a unique ID for you. |
Thanks in advance for support
