Splunk IT Service Intelligence

Splunk ITSI and ServiceNow - Auto populate fields

taskar
Path Finder

Hi, I have installed and configured the Add-on for ServiceNow. Integration with notable events are working, incidents are created in Service Now. But I would like to have the fields auto populated from the notable event. See screenshot.

Is it possible to have a two-way communication? close the Notable Event when ServiceNow ticket is closed i.e.

Any tip?
alt text

0 Karma
1 Solution

taskar
Path Finder

Splunk_TA_snow/local/local/alert_actions.conf is the config file for populating the fields. But havent found any way to use use token variables such as %orig_description%, %orig_owner%, %orig_severity%, %orig_status%, and so on.

View solution in original post

0 Karma

AnilPujar
Path Finder

Could not run the action. Status: 500 (Internal Server Error) Details: Splunkd daemon is not responding: ("Error connecting to /servicesNS/nobody/-/service_now_incident/snow_incident: ('The read operation timed out',)",)

I'm getting this error, After Clicking Done on the same above screenshot

0 Karma

taskar
Path Finder

Splunk_TA_snow/local/local/alert_actions.conf is the config file for populating the fields. But havent found any way to use use token variables such as %orig_description%, %orig_owner%, %orig_severity%, %orig_status%, and so on.

0 Karma

MVREID
Path Finder

have you tried to use $result.orig_description$. That format was used for other alerting methods.

0 Karma

taskar
Path Finder

thanks for your reply. I've tried what you suggest - dont work any better. A workaround is to use Alerts instead of the ServiceNow integration in ITSI. Then tokens are working as expected. Rumors as it that a new integration with servicenow is coming Q1 2019. Fingers crossed

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...