Integrate Servicenow with Splunk to create incident based on alerts

[amu00001]

we are considering different way to integrate Splunk with Servicenow to create incident based on alerts and trying to understand which is the better way to integrate  and Why ?

1. Using OOB Splunk add on and ServiceNow OOB "Splunk Integration" plugin/app.

2.Inbound Email Action(create ticket in servicenow based on email generated from Splunk).

3.Using Rest API(import set rest api /table API to create incidents in service now)

[luffy3478]

If you already have the subscription going with OOB plugin approach is easy and best way.

1. integration is pre built with best practices

2. event rules for auto creation of incidents