how to create incident from an triggered alert

[avni26]

Hi,

I'm trying to create a alert action to create a incident when any alert gets triggered.
Whats the best way to achieve it,Please suggest.

[manjunathmeti · Accepted solution]

To create incident in ServiceNow from Splunk:

Step 1: Install Splunk Add-on for ServiceNow: https://splunkbase.splunk.com/app/1928/

Step2: Setup add-on by following steps here: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Setuptheadd-on#Set_up_using_Splunk_...

Step 3: Create incidents using custom alert action: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Usecustomalertactions#ServiceNow_In...

[cduffey_splunk]

Is there a specific system you are wanting to create in (e.g. ServiceNow), or is it a customer system?

[avni26]

@cduffey yes, for ServiceNow system.