How can I get a list of alerts with cut service now incident?

[mahesh27]

I have many alerts in splunk, now i want to get the list of alerts where cut service now incident is configured.
how can i get this???

[richgalloway]

To get a list of alerts with ServiceNow actions, use this REST query

| rest /servicesNS/-/-/saved/searches splunk_server=local 
| search alert_type!="always" 
| fields eai:acl.app title action.snow_incident.*

I'll let you determine which action fits your needs.

[mahesh27]

Thank you @richgalloway 

Can you please let me know what roles and capabilities will be given in order to see cut service now action items while creating alerts.

[richgalloway]

I don't know which roles or capabilities are needed.  All of my accounts have the admin role, but lower access may work, too.