Splunk Enterprise Security
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

Splunk Alert using Splunk ITSI Notable Event - Creating a Service Now Incident

t_splunk_d
Path Finder
‎01-15-2019 05:25 PM

In Splunk Enterprise I have alerts. Now I want to create Servicenow incidents by adding the alert action using ITSI Notable Events.

Following are my questions:

  1. Whether the above approach is doable ( assuming that all required apps are in-place and configurations complete and working)
  2. Is it possible to create an incident by sending all the ServiceNow field's value? Is this out of the box? I am sure it is not. Because I can only see few basic fields.
  3. What needs to be done to pass all the values to ServiceNow? I want to populate all the field's values in a ServiceNow incident. Do i need to change the .py (not able to remember the name)?

The existing Splunk alert has all the values (including resolution etc.). Currently it is a manual effort of copy and paste in the ServiceNow incident which I want to automate.

Reply
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...