I don't have a solution specifically for Splunk and I'm also assuming ServiceNow does more than change management, like work orders, asset tracking, and project management?
We currently use our work order system to email out to specific stakeholders on who needs to be notified of the ticket status/resolution. So for this example, we would add the SOC email address for notification of ticket statuses. When the ticket was completed the work order system would generate an email to the SOC. The SOC would then keep a record of it for reference later if need be.
I'd also be interested if someone else has this all automated together, from initial user request, supervisor approval, work completed, and automatically logged into a SIEM to correlate the event alerts.
Just curious, how much time does it take to cross reference that manually? How much time would that save over a set period of time?
