Splunk Cloud Platform

Unable to add Description in ServiceNow Incident Alert

yuvaraj_m91
Loves-to-Learn Lots

My Objective is to create an Alert in ServiceNow whenever an failure alert triggered in SPlunk.
I have installed Splunk Add on for ServiceNow and configured the connection setup. 
I was able to successfully post the incident is ServiceNow with the default fields available in ServiceNow Incident Alert.
However i need to update the Description field in ServiceNow with the details of Alert Name and Alert Result to identify why that alert triggered.

Labels (2)
0 Karma

KendallW
Contributor

Hi @yuvaraj_m91 You can reference the required fields in your Splunk alert config using $name$ for the alert name and $result.field$ for other fields

0 Karma

yuvaraj_m91
Loves-to-Learn Lots

I tried to update  $result.field$  in the Description of Custom fields as in the screenshot, but it is not updating in servicenowTEST.jpg

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...