In Splunk Enterprise I have alerts. Now I want to create Servicenow incidents by adding the alert action using ITSI Notable Events.
Following are my questions:
- Whether the above approach is doable ( assuming that all required apps are in-place and configurations complete and working)
- Is it possible to create an incident by sending all the ServiceNow field's value? Is this out of the box? I am sure it is not. Because I can only see few basic fields.
- What needs to be done to pass all the values to ServiceNow? I want to populate all the field's values in a ServiceNow incident. Do i need to change the .py (not able to remember the name)?
The existing Splunk alert has all the values (including resolution etc.). Currently it is a manual effort of copy and paste in the ServiceNow incident which I want to automate.
