Getting Data In

Need to stop flodding of incidents in servicenow from splunk


I have below setting to generate incidents in Servicenow. This alert is schedule  to trigger after every 5 min. But it will create number of incidents in Servicenow as coorelation_id is unique for every alert. 

I need to stop flodding of incidents in servicenow. I need to 
1)Create incident in Servicenow if alert triggers e.g P1
2)Update the same  incident P1 till the time its state is closed or resolved in Servicenow.
3)If incident_state is resolved /closed . Then only it will create new incident P2. 

So that it can prevent flodding of incident in Servicenow.
also, not sure how we can set-up coorelation_id in that case.

Please helpsag5757_1-1597834922327.png





Labels (1)
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...