Splunk Enterprise Security

ServiceNow Event Integration

vamshikn72
Explorer

Hi Splunkers, How to create Incidents on SNOW from Splunk SPL? We have "ServiceNow Event Integration" alert action in use which creates incidents when an alerts triggers an event but trying to use the same from Splunk search.

Tried using sendalert command as below and got an error:

| sendalert servicenow param.severity="4" param.assigned_to="Assignment group" param.short_description="Alert Name" param.description="This is a test"
param.u_environment="Dev" param.node=hostname param.resource="Nothing" param.type="Name"

Error: Error in 'sendalert' command: Alert action "Servicenow" not found.

Labels (2)
0 Karma
1 Solution
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...