Currently we are using Service Now for incident tracking at my organization. Recently, my department purchased a Splunk license. I am not an admin in Splunk, just researching the possibility of integrating Splunk with Service Now. Specifically, I am interested in Advanced Reporting. My team would like to be able to have Splunk pull Service Now Incident information, and then create reports to analyze the team's performance. Specifically, we would like to build a "touched by report" that tracks incoming and outgoing tickets. We want this report based on assignment groups, by assignee (person who is resolving the ticket), and by person's interaction (any user who has in any way change or logged a comment on the ticket). - Incoming tickets would be incidents that are created in a certain groups queue (in service now) or open tickets transferred into a groups queue (in service now) - Outgoing tickets would be incidents that are cancelled, resolved by a certain groups queue (in service now) or open tickets transferred into a different groups queue (in service now) Basically, my question is this, can Splunk track the change history of a Service Now Incident? Does it create an event each time the Incident is changed? Also what apps / add-ons are needed? Are both of these needed? -Splunk Add-on for ServiceNow -Splunk App for ServiceNow ... View more