Hi All, I am currently building a Splunk showcase for customers as part of which i've simulated an application failure and latency within the application, i've generated JSON logging as part of this and created alerts off the back of this when the latency & application availability errors are detected in the index.  The alerts are successfully running and generating incidents in a queue in ServiceNow using the Splunk Add-on for ServiceNow.  At the moment i'm having to manually close the incidents when they are raised, but i want to add in a check that auto-closes the Incident in ServiceNow when the conditions are no longer true showing that the issue has now been resolved. Can anyone help provide any insight in the best way to do this? I've worked on Splunk environments before where an incident would auto-close when the Splunk process had stopped on a SH or UF and had now been restarted and is back online, but not at this level. Thanks in advance ... View more