Splunk Enterprise Security

Splunk Alert using Splunk ITSI Notable Event - Creating a Service Now Incident

t_splunk_d
Path Finder

In Splunk Enterprise I have alerts. Now I want to create Servicenow incidents by adding the alert action using ITSI Notable Events.

Following are my questions:

  1. Whether the above approach is doable ( assuming that all required apps are in-place and configurations complete and working)
  2. Is it possible to create an incident by sending all the ServiceNow field's value? Is this out of the box? I am sure it is not. Because I can only see few basic fields.
  3. What needs to be done to pass all the values to ServiceNow? I want to populate all the field's values in a ServiceNow incident. Do i need to change the .py (not able to remember the name)?

The existing Splunk alert has all the values (including resolution etc.). Currently it is a manual effort of copy and paste in the ServiceNow incident which I want to automate.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...