Splunk Priority

[debjit_k]

Hi All,

Just wanted to know we have splunk ES and we use servicenow to triggered alert now my question is if there are few alert which I want to give Priority as P2 how can I do it in splunk as splunk by default priority is P3. 

[gcusello]

Hi @debjit_k ,

are you speaking of Splunk Support priority or Priority in ES Correlation searches?

if Splunk Support, you define the Priority of your Cases when you oprn them.

If you're speaking of Priority in ES Correlation Searches, it's assigned to the associated assets or identities and with the Severity of the Correlation Search it determines the Urgency of a Notable.

Ciao.

Giuseppe

[debjit_k]

Hi @gcusello,

Thanks for the response 

I'm talking about splunk ES correlation search. I put the splunk notable priority as high but when it is generating ticket at servicenow it is coming as P3, not sure why. Can you please help me to fix this issue 

[gcusello]

Hi @debjit_k,

I don't know how this add-on works and I don't know python, but priority is defined in the code of one of the python scripts (snow_incident_base.py) that you can find in bin folder.

Ciao.

Giuseppe