Splunk Search

create ticket in service now - arguments missing

multiverse
Engager

It’s worth noting that this issue is being tested under the Splunk application for OS X. The goal is to get Splunk creating tickets in Service Now based on scheduled alerts. My working example is a WARN when a disk crosses the threshold of 20% available.

The search I have scheduled in Splunk looks like this:

index=* sourcetype=df | multikv | eval perc_used=trim(UsePct, "%") | search perc_used >= 80

I have put the rest of the gory details here so as not to abuse this forum:

http://themap.multiverse.org/snow_alert-sh-does-not-create-service-now-ticket-when-scheduled-under-s...

Thank you very much

Tags (1)
0 Karma

ashish_test
New Member

Link Provided is not displaying contents. Error 404:Page not found !
Can you please share the information about how we can create the tickets in servicenow using splunk.

0 Karma

jonuwz
Influencer

I've read the link. How are you authenticating within the snow script when its called from an alert ? When you run it from the CLI it looks like you need to enter a username / password.
Also - what arguments do you think are missing ? Have you added debug to the script and redirected it to file to see where i tgoes wrong ?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

Another quarter, another wave of innovation. From complex integrations to pushing the limits ...

Federated Search for Dynamic Data Self Storage Is Now Generally Available on Splunk ...

 Splunk is excited to announce the General Availability of Federated Search for Dynamic Data Self Storage ...

Index This | What has many keys but can’t unlock a door?

July 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...