To create a multiple record Splunk alert with custom fields, you must build a search
that is designed to match the ServiceNow columns you want to populate.
시작하기 전에
Role required: sn_si.admin
프로시저
-
Navigate to Search.
-
In the Search box, create a search that generates your
record data.
See the
examples
for recommended search criteria.
-
Click Save As and select
Alert.
-
Set the name, permissions, and schedule, as needed.
-
Click Add Actions.
-
Make one of the following selections.
- To create one event per result from your search, select
Create Multiple ServiceNow Security
Events.
- To create one incident per result from your search, select
Create Multiple ServiceNow Security
Incidents.
-
Set any defaults, as needed.
If the field in the search result is blank or not present, the defaults
are used. If there is a value in the result, the defaults are overwritten.