Integrate ServiceNow with Splunk Observability Cloud

Use the ServiceNow integration API to set up your ServiceNow integration with additional customization options beyond those available in the Data Setup section of the Splunk Observability Cloud user interface. For example, you can assign specified values for some ServiceNow parameters such as caller_id, impact, and so on, to provide more information about your incidents by using template variables in the custom payloads.

To learn more about custom payloads and other parameters in the request and response bodies of the ServiceNow integration API, see Integrations API.

For examples of custom payload, see the Custom payload examples section in the same topic.

Alternatively, if you don't need a lot of customization and want to use a simple configuration for your ServiceNow integration, see the Send alert notifications to ServiceNow using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation.

When you send an API request, you need to use the endpoint specific to your organization's realm. To learn more, see Realms in endpoints.

 Default payload examples

You can send alerts in Splunk Observability Cloud to ServiceNow as problems, incidents, or events. You can also customize alerts to make sure responders have the context needed to resolve the issues.

For the full list of variables available for customization, see the ServiceNow template variables section in the same topic.

The following examples show default payloads for ServiceNow alerts.

 Problem alert type examples

Example for alertTriggeredPayloadTemplate:

JSON
{
    "correlation_display": "{{{incidentSource}}}",
    "correlation_id": "{{{incidentId}}}",
    "short_description": "{{{messageTitle}}}",
    "description": "{{{messageBody}}}",
    "impact": "{{{impact}}}",
    "urgency": "{{{impact}}}",
...
Show More

Example for alertResolvedPayloadTemplate:

JSON

{
    "state": "4",
    "close_code": "Closed/Resolved by Caller",
    "comments": "{{{messageTitle}}}",
    "close_notes": "{{{messageBody}}}"
}

 Import set alert type examples

• For the ImportSet integrations, Splunk Observability Cloud adds the u_ prefix to all variables in default payloads. For example, description becomes u_description in the default payloads.
• When you send customized payloads for the ImportSet integrations, make sure the variable names completely match what is defined in ServiceNow.

Example for `alertTriggeredPayloadTemplate:

JSON

{
    "u_description": "{{{messageBody}}}",
    "u_short_description": "{{{messageTitle}}}",
    "u_caller_id": "{{{callerId}}}",
    "u_correlation_display": "{{{incidentSource}}}",
    "u_impact": "{{{impact}}}",
    "u_correlation_id": "{{{incidentId}}}",
    "u_urgency": "{{{impact}}}"
}

Example for alertResolvedPayloadTemplate:

JSON

{
    "u_close_notes": "{{{messageBody}}}",
    "u_comments": "{{{messageTitle}}}",
    "u_state": "6",
    "u_close_code": "Closed/Resolved by Caller",
    "u_correlation_id": "{{{incidentId}}}"
}

 Incident alert type examples

Example for alertTriggeredPayloadTemplate:

JSON
{
    "correlation_display": "{{{incidentSource}}}",
    "correlation_id": "{{{incidentId}}}",
    "short_description": "{{{messageTitle}}}",
    "description": "{{{messageBody}}}",
    "impact": "{{{impact}}}",
    "urgency": "{{{impact}}}",
...
Show More

Example for alertResolvedPayloadTemplate:

JSON

{
    "state": "6",
    "close_code": "Closed/Resolved by Caller",
    "comments": "{{{messageTitle}}}",
    "close_notes": "{{{messageBody}}}"
}

 Event alert type examples

Example for alertTriggeredPayloadTemplate:

JSON
{
    "records": [
        {
            "source": "{{{incidentSource}}}",
            "node": "{{{entityId}}}",
            "metric_name": "{{{originatingMetric}}}",
            "description": "{{{messageBody}}}",
...
Show More

Example for alertResolvedPayloadTemplate:

JSON
{
    "records": [
        {
            "source": "{{{incidentSource}}}",
            "node": "{{{entityId}}}",
            "metric_name": "{{{originatingMetric}}}",
            "description": "{{{messageBody}}}",
...
Show More

 Template variables

You can use the following template variables to construct custom payloads for your ServiceNow integration:

• Unless otherwise indicated in the description, all variables are of type string.
• Unless otherwise indicated in the description, all variables are available for Event, ImportSet, Incident, and Problem integrations.
• When a variable is optional, it means it's not always available. If you use an optional variable that isn't available in the present conditions to construct your payload, Handlebars converts it to an empty string.
• For the ImportSet integrations, Splunk Observability Cloud adds the u_ prefix to all variables in default payloads. For example, description becomes u_description in the default payloads.

 inputs array

Each object in the inputs array is named after the program variable it’s bound to. If an object isn’t bound to a program variable, it uses a name like _S0, _S1, and so on.

Each input object contains the following elements:

 Helper functions

Apart from using template variables to customize your payload, you can also use the following helper functions to make sure the right value is set on the outgoing alert.