Parent incident not generated child incident

[reddyvenugo]

Hi Team,

we have one issue regarding child incident not generated for parent incident when the email communication happened on a closed parent incident which was working earlier.

Here what we need to check and what could be the reason behind not generating a child incident when a email communication happened on the closed parent incident.

Please provide your answers as early as possible.

[sivaji nadigatl]

What to Check

1. Inbound Email Record (sys_email)

   • Confirm the email is received and linked to the parent incident.
   • Check if the watermark or In-Reply-To header is present in the email.

2. Notification Template

   • Ensure the original outbound email still includes the ${watermark} token in the subject/body.
   • If watermark is missing or altered, ServiceNow cannot match the reply to the parent.

3. Inbound Email Action / Flow

   • Verify the inbound action or Flow Designer logic that creates child incidents:
     • Is it active?
     • Does the condition allow processing when state = Closed?
     • Any recent changes to conditions or scripts?

4. Business Rules / Script Includes

   • Check if any logic was added to block child creation when the parent is closed.
   • Look for guards like:
     if (parent.state == 'Closed') return;

5. ACLs and Role Changes

   • After Zurich or recent upgrades, scripting governance may require the script_writer role.
   • Ensure the inbound email process runs under a user with permissions to insert incidents.

6. Error Logs

   • Check sys_email for Stop Processing flag.
   • Review System Logs for errors during inbound processing.

7. Update Sets / Recent Changes

   • Review recent changes to inbound actions, flows, or notification templates.

---

Possible Reasons

• Watermark missing → Email reply cannot link to parent.
• Inbound Action inactive or condition changed → Logic skips closed incidents.
• Flow Designer unpublished or condition mismatch → No child creation triggered.
• Business Rule updated → Added restriction for closed state.
• ACL or governance changes → Insert blocked due to role or script restrictions.
• Stop Processing flag → Email processing halted.
• Notification template modified → Watermark removed or altered.

---

Quick Fix Approach

• Restore watermark in notifications.
• Update inbound action/flow to allow child creation even if parent is closed.
• Validate ACLs and script permissions.

• Add logging in inbound logic for better troubleshooting.

[Laveena-Agarwal]

Hi @reddyvenugo 

Is your issue resolved?