Get Common Fields (and values) via rest API

[isoscow]

I created a Python script that successfully links episodes with my 3rd party ticketing system. I'm trying to populate that ticket system with some of the "common field" values associated with a given episode but I don't see a good way to do that?  Anyone have any hints on how to accomplish this? I'm probably missing something very obvious in the documentation.

thx!

[skramp]

Hi @isoscow , I am doing this regulary, I create a new event with a correlation search which is added to my episode. In this event there are new fields with the value I want to send to my ticketing system. My Action Rule in my NEAP reacts on this fields. Here is also the conf talk Peter Zumbrink and I did this year at .conf24 where we are telling how we are doing this: https://conf.splunk.com/watch/conf-online.html?search=OBS1137C#/

[proyleJDS]

What incident management software are you using?

[KendallW]

Hey @isoscow not sure if ideal/best practice/current, but we created alerts which dump results to a csv file using "| outputcsv", which also run a script as part their alert actions. The script sends the data from the csv to the third party ticketing system.