Splunk Add-on for ServiceNow: How to create a new ServiceNow incident every time a new Splunk alert is triggered.

Applicability

Splunk Apps and Add-ons

Description

Splunk Add-on for ServiceNow offers "ServiceNow Incident Integration" alert action out of the box. This alert action enables Splunk to create a ServiceNow incident when an incident is triggered.

However you may notice that when a subsequent alert is triggered, instead of creating a new incident, Splunk actually attempts to update the incident created earlier.
 

Investigation

The above-mentioned behaviour is explained here: 
User custom alert actions

In a custom alert action, if you leave this value blank, the Splunk software does not generate a random UUID, but generates a correlation ID based on a MD5 hash of your alert name, owner and the app name.
 

Resolution

The following steps ensure a unique correlation ID is created every time a new alert is triggered:

1) Append this query into the search portion of the alert action:

| eval unique_id= random() + now()

2) After that, navigate to Alert Action > Correlation ID > and put this for the value:

$result.unique_id$

3) Save the Alert Action.

By having a new, unique Correlation ID each time, a new incident should be created.
 

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release