ServiceNow Event Integration

[vamshikn72]

Hi Splunkers, How to create Incidents on SNOW from Splunk SPL? We have "ServiceNow Event Integration" alert action in use which creates incidents when an alerts triggers an event but trying to use the same from Splunk search.

Tried using sendalert command as below and got an error:

| sendalert servicenow param.severity="4" param.assigned_to="Assignment group" param.short_description="Alert Name" param.description="This is a test"
param.u_environment="Dev" param.node=hostname param.resource="Nothing" param.type="Name"

Error: Error in 'sendalert' command: Alert action "Servicenow" not found.

[somesoni2 · Accepted solution]

Have a look at this

https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Usecustomsearchcommands