Is there Documentation for Updating an incident using ServiceNow add-on for Splunk (Splunk_TA_snow)

[ramganeshn]

Hi,

I am trying to update an incident that was created by an alert action from Splunk ITSI. But, everytime the alert gets triggered, a new incident is getting created instead of updating the existing incident. I tried everything mentioned in the link given below:

https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Commandsandscripts#Update_behavior_...

Please guide as to what needs to be done to update a previously created incident? Should I need to get the status of the incident from ServiceNow and use that in the search query when I try to update the incident? 

It would be great if you could help me with any documentation or a video reference that could help me in performing this activity of updating an incident that was created already.

Thanks!