Splunk Cloud Platform

Is there Documentation for Updating an incident using ServiceNow add-on for Splunk (Splunk_TA_snow)



I am trying to update an incident that was created by an alert action from Splunk ITSI. But, everytime the alert gets triggered, a new incident is getting created instead of updating the existing incident. I tried everything mentioned in the link given below:


Please guide as to what needs to be done to update a previously created incident? Should I need to get the status of the incident from ServiceNow and use that in the search query when I try to update the incident? 

It would be great if you could help me with any documentation or a video reference that could help me in performing this activity of updating an incident that was created already.


0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Starting With Observability: OpenTelemetry Best Practices

Tech Talk Starting With Observability: OpenTelemetry Best Practices Tuesday, October 17, 2023   |  11AM PST / ...