Stop creating incident through email if more records found

[siva14]

Hi All,

We have a requirement that, update incident create inbound action to search for email from this sender received in the last 4 hours with target table of incident. if more then 20 found, do not create record and do not allow to continue processing other inbound actions

How can I achieve this one.

Any help would be appreciated. Thanks in Advance.

#inbound #script include

[Sai_Charan_K]

Hi @siva14 ,

Please try the below script in your inbound email action:

// Get the sender's email address
var senderEmail = email.origemail;

// Set the time frame to check (last 4 hours)
var fourHoursAgo = new GlideDateTime();
fourHoursAgo.addHoursUTC(-4);

// Query the `sys_email` table for emails received from the sender in the last 4 hours
var emailCountGR = new GlideRecord('sys_email');
emailCountGR.addQuery('user_id', senderEmail); // Match the sender email
emailCountGR.addQuery('time_of_event', '>=', fourHoursAgo); // Filter for last 4 hours
emailCountGR.addQuery('target_table', 'incident'); // Ensure target table is 'incident'
emailCountGR.addQuery('type', 'received'); // Only check received emails
emailCountGR.query();

// If more than 20 emails are found, do not create an incident and stop further processing
if (emailCountGR.getRowCount() > 20) {
    gs.log("More than 20 emails received from sender: " + senderEmail + " in the last 4 hours. Skipping incident creation.", "Inbound Email Action");
    // Return false to prevent the inbound action from continuing and creating an incident
    stopProcessing = true; // Set a flag to prevent further actions
    event.state = 'stop_processing'; // Mark the inbound action state to stop further execution
    return;
}

Please mark this answer as "helpful" and mark it as "correct" If you feel this helped you in anyway.

Thanks and Regards,

K. Sai Charan

Sr. ServiceNow Developer 

Deloitte India 

[siva14]

Hi @Sai_Charan_K , i have tried below script, but still it is not stopping the incident creation

var senderEmail = email.origemail;

gs.log(email.origemail, "Inbound Email Action:  Create Incident");

var emailCountGR = new GlideRecord('sys_email');

//emailCountGR.addQuery('user_id', 'f1ad308cdb218fc0536c776baf9619a8');//senderEmail);

emailCountGR.addEncodedQuery('sys_created_onRELATIVEGT@hour@ago@4');

emailCountGR.addQuery('target_table', 'incident');

emailCountGR.addQuery('type','received');

emailCountGR.addQuery('receive_type', 'new');

emailCountGR.query();

if (emailCountGR.getRowCount() > 20) {

    gs.log("More than 20 emails received from sender: " + senderEmail + " in the last 4 hours. Skipping incident creation.", "Inbound Email Action: REI Create Incident");

    stopProcessing = true;

    event.state = 'stop_processing';

[Sai_Charan_K]

Hi @siva14,

Did you check the if statement logs ?

What error are you getting when your inbound email action is run?

Thanks and Regards,

K. Sai Charan

[siva14]

More than 20 emails received from sender: solarwinds@snow.com in the last 4 hours. Skipping incident creation.

but still incident is created