Getting Data In

Need to stop flodding of incidents in servicenow from splunk

sag5757
Explorer

I have below setting to generate incidents in Servicenow. This alert is schedule  to trigger after every 5 min. But it will create number of incidents in Servicenow as coorelation_id is unique for every alert. 

I need to stop flodding of incidents in servicenow. I need to 
1)Create incident in Servicenow if alert triggers e.g P1
2)Update the same  incident P1 till the time its state is closed or resolved in Servicenow.
3)If incident_state is resolved /closed . Then only it will create new incident P2. 

So that it can prevent flodding of incident in Servicenow.
also, not sure how we can set-up coorelation_id in that case.


Please helpsag5757_1-1597834922327.png

 



new2.PNG

sag5757_2-1597835079415.png

 

0 Karma
Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...