Thanks this worked. After calling in support from Splunk side (wasnt able to help due to vendor app), totally understand, also called in support to Service now, which had no idea about the add-on (https://splunkbase.splunk.com/app/4770/) this fixed our issue with getting notable events into service now for alerting by tweaking that (mode="rt") Thanks
... View more