NOTE: Please make sure that service-now application is configured to receive email from splunk server. Might be the exchange server needs to have the configuration.
For creating SNOW incident we have to follow the below steps –
1. Let’s say you need to raise an incident from this alert.
eg: index=_internal|stats count by host
2. In alert actions select option send email.
3. Then configure the email ID of service-now server in To address:
4. In mail body, you need to write an XML with required fields to be passed over to incident, lets take
the following sample xml(modify it as per requirement) :
5. Then click on save.
Hopefully this helps you to create a service now incident directly from Splunk.
If you are still facing issue regarding create servicenow incident through splunk Feel free to Ask Doubts in the Comment Box Below and Don’t Forget to Follow us on 👍 Social Networks, happy Splunking >😉