Splunk Add-on for ServiceNow to create RITM instead of Incident tickets

[pinksqtuason]

We are currently working on a use case where we'd like to automate the creation of tickets via ServiceNow.  The Splunk will trigger an alert and then will create an RITM in ServiceNow.
We are utilizing the Splunk Add-on for ServiceNow and in our alert configuration, the ServiceNow Incident Integration action trigger is selected.
The api endpoint that we have defined is pointing to creation of RITM, however, in our testing it is not creating any RITM.
We tried to run test it via POSTMAN, the credentials, payload and api endpoint are all working.  Trying to replicate this in Splunk, it's not working.

Is there a way for us to still utilize this add on to create RITM?

[tej57]

Hey @pinksqtuason,

I think you're using snowincidentalert command or the action while configuring the alert. Instead, can you confirm if you've tried creating event using the snowevent command in the SPL itself? 

You can find the reference here - https://splunk.github.io/splunk-add-on-for-servicenow/Commandsandscripts/

The document mentions you'll need Event Management Plugin. Please check and confirm if it works for you. By default, the alerting mechanism will create a servicenow incident only.

Thanks,
Tejas.

---
If the above solution helps, an upvote is appreciated..!!