Incident should be closed immediately once it's created if a short description contains "xxxxxxxxxx"

Nagurbee1 · ‎02-28-2024

Hi Team

Recently I got a one requirement that Incident should be auto closed immediately once it's created if a short description contains "xxxxxxxxxx" and watch list contains "xxxx email id" and assignment group is "xxxx".

In my instance , every day one incident is getting created and auto assigning to a group "xxxx", so "xxxx" group people requested us be auto close it immediately once it's created in ServiceNow as they don't that ticket any more.

Could you please suggest that how to auto close the incidents if the above conditions are met ?

Thanks in advance

Nagurbi

Amit Verma · ‎03-03-2024

Hi @Nagurbee1

Probably, it's a flow then which is creating the incident on the reception of email. Search for flows with trigger type as email and check. Also, creating a before insert business rule on the incident table should do the trick as you are restricting the insert operation itself which is independent of the source.

For the issue with selecting a dynamic watch list recipient, can you please confirm if you have an account created for the DL in your instance. If not, then we need to script the condition to check Watch List users.

Thanks & Regards

Amit Verma

Please mark this response as correct and helpful if it assisted you with your question.

View solution in original post

AshishKM · ‎02-28-2024

Hi @Nagurbee1 ,

Write after insert BR on incident table with applied condition on following fields.

Short Description
Assignment group
Watch List

If condition matched then change the incident state in Action section.

-Thanks,

AshishKM

Please mark this response as correct and helpful if it helps you can mark more that one reply as accepted solution

Nagurbee1 · ‎03-14-2024

Hello Ashish

I have prevented incident creation it self using before insert business rule.

Thank you so much for your suggestion.

AshishKM · ‎03-14-2024

good to here , I suggested after BR because you mention “close after created” . seems like now u don’t want those incidents to be created .. are you aborting the process.

Please mark this response as correct and helpful if it helps you can mark more that one reply as accepted solution

Nagurbee1 · ‎03-14-2024

Yes Ashish, initially I have planned to close after created as I am not aware of the source of the incident creation.

I have tried by creating before insert business rule and aborted the action, it worked.

Thank you so much for your inputs.