How to find Incident generated using Inbound Email Action or Record Producer?

[VIKASM535239375]

How to find Incident generated using Inbound Email Action or Record Producer?

If  Inbound Email Action  How can we find Inbound Email Action Name from Incident created or Email in Zurich version

[JenniferRah]

Copy the sys_id of your incident.

Go to System Logs - Emails. 

In the filter, add Target IS {paste your sys_id}. 

Click Run.

That should show you the email that generated the incident.  Open that record up and look at the Email Log tab. Find the record that begins with "Processed". That will tell you the inbound action that was used.

[VIKASM535239375]

Hi Jennifer,

Thank you for your reply. Unable to see processed in Email Log.

[JenniferRah]

Something had to be processed or it wouldn't have created the item. I would read through the log entries in that email record and see if it gives you some clues as to what ran and what was skipped.

[KingC]

Finding Incident Source: Inbound Email Action vs Record Producer

Quick Reference Table

Source Key Identifier Field Table to Check

Record Producer	sys_created_by = "guest" or specific user	sc_cat_item
Inbound Email Action	opened_by populated, correlation fields	sys_email

---

Method 1: Check the Activity Stream/Audit History

Steps:

1. Open the Incident record
2. Scroll to Activity Stream or click "History" related list
3. Look for the first entry showing creation source
4. Email-generated incidents show "Created from email" notation

---

Method 2: Check the sys_email Table (For Email-Generated Incidents)

Query to Find Associated Email:

Navigate to System Mailboxes then Emails then Received

Filter conditions:

• Target table = incident
• Target = [incident sys_id]

OR use this encoded query in the sys_email table:

target_table=incident^target=[INCIDENT_SYS_ID]

Key Fields to Examine:

Field Purpose

target_table	Should be "incident"
target	Links to incident sys_id
mailbox	Shows which mailbox received it
subject	Original email subject
direct	Shows if email created the record

---

Method 3: Find the Inbound Email Action Name (Zurich Version)

Option A: Check sys_email Record

Steps:

1. Go to System Mailboxes then Emails then Received
2. Find the email that created the incident
3. Look at the "Action Taken" or related fields
4. The email record may show which action processed it

Option B: Query sys_email with Script

Background Script to Find Email Action:

// Find email that created a specific incident
var incidentSysId = 'YOUR_INCIDENT_SYS_ID';

javascript var gr = new GlideRecord('sys_email'); gr.addQuery('target_table', 'incident'); gr.addQuery('target', incidentSysId); gr.query();

javascript while (gr.next()) { gs.info('Email ID: ' + gr.getValue('sys_id')); gs.info('Subject: ' + gr.getValue('subject')); gs.info('Mailbox: ' + gr.getDisplayValue('mailbox')); gs.info('Created: ' + gr.getValue('sys_created_on')); }

Option C: Check System Logs

Navigate to:
System Logs then System Log then All

Filter:

• Created around incident creation time
• Source contains "email" or "InboundEmail"
• Message contains incident number