Event Field Mapping
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
3 weeks ago
I am getting an email in ServiceNow as below:
Organization: XYZ
Description: XYZ Jump-box for on-premise Domain controllers
Location: Main Office
Device: DEF
View device: Device_URL
Role: WINDOWS_SERVER
Time: 14 Aug 2025, 06:05:05
Severity: OK
Priority: LOW
Type: Condition
Status: Triggered
Message: Windows Service: 'Citrix Subscriptions Store (CitrixSubscriptionsStore)' is Stopped at '2025-08-14T05:03:12Z
I have an inbound action that will create an event and associate an alert/ Incident to it. I want the CI field on the alert form to be populated with the Device name (DEF) from the email content. How to do this?
What I have done till now -
1. Created event field mapping
2. Pushed the content in payload format in the additional_info field.
3. This works, but the data needs to be in JSON, and the incoming data is in string from mail.
--> Is there a way to use the event mapping for string data and use regex to find the dynamic value after the word 'Device'??
Or any alternate solution to get this done?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
3 weeks ago - last edited 3 weeks ago
@SwapnilC, you could try something like below.
Also, if there is a scenario where you don't get any device name then you need to update the Regex as well. Just in case if you are getting a different email body.
// var incomingText = email.body_text; // Assuming you're capturing from an email body. For testing purposes I am hardcoding in text format to get the email body as plain text.
var body = `Organization: XYZ
Description: XYZ Jump-box for on-premise Domain controllers
Location: Main Office
Device: DEF
View device: Device_URL
Role: WINDOWS_SERVER
Time: 14 Aug 2025, 06:05:05
Severity: OK
Priority: LOW
Type: Condition
Status: Triggered
Message: Windows Service: 'Citrix Subscriptions Store (CitrixSubscriptionsStore)' is Stopped at '2025-08-14T05:03:12Z`;
// Regex pattern to extract the device name
var pattern = /Device:\s*(?!View)([A-Za-z0-9_-]+)/;
var match = body.match(pattern);
if (match) {
var deviceName = match[1]; // Extracted device name
// Now you can set this value to the CI field. I am logging for testing purposes.
gs.info(deviceName);
} else {
// Handle the case where no match is found
gs.info("No device name found in the incoming text.");
}
Let me know if this helped!
Regards,
Vikas K