I'm trying to create a alert action to create a incident when any alert gets triggered.
Whats the best way to achieve it,Please suggest.
To create incident in ServiceNow from Splunk:
Step 1: Install Splunk Add-on for ServiceNow: https://splunkbase.splunk.com/app/1928/
Step2: Setup add-on by following steps here: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Setuptheadd-on#Set_up_using_Splunk_...
Step 3: Create incidents using custom alert action: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Usecustomalertactions#ServiceNow_In...
View solution in original post
Is there a specific system you are wanting to create in (e.g. ServiceNow), or is it a customer system?
@cduffey yes, for ServiceNow system.