Event Field Mapping

Not applicable

‎08-14-2025 11:30 PM

I am getting an email in ServiceNow as below:

Organization: XYZ
Description: XYZ Jump-box for on-premise Domain controllers
Location: Main Office
Device: DEF
View device: Device_URL
Role: WINDOWS_SERVER
Time: 14 Aug 2025, 06:05:05
Severity: OK
Priority: LOW
Type: Condition
Status: Triggered
Message: Windows Service: 'Citrix Subscriptions Store (CitrixSubscriptionsStore)' is Stopped at '2025-08-14T05:03:12Z

 

I have an inbound action that will create an event and associate an alert/ Incident to it. I want the CI field on the alert form to be populated with the Device name (DEF) from the email content. How to do this?


What I have done till now -

1. Created event field mapping 

2. Pushed the content in payload format in the additional_info field.

3. This works, but the data needs to be in JSON, and the incoming data is in string from mail.

--> Is there a way to use the event mapping for string data and use regex to find the dynamic value after the word 'Device'??

Or any alternate solution to get this done?

0 Helpfuls

VikMach
Mega Sage

‎08-15-2025 01:35 AM - edited ‎08-15-2025 02:01 AM

@Community Alums, you could try something like below.

VikMach_0-1755248221263.png

 

Also, if there is a scenario where you don't get any device name then you need to update the Regex as well. Just in case if you are getting a different email body.

VikMach_1-1755248337739.png

 



// var incomingText = email.body_text; // Assuming you're capturing from an email body. For testing purposes I am hardcoding in text format to get the email body as plain text.
var body = `Organization: XYZ
Description: XYZ Jump-box for on-premise Domain controllers
Location: Main Office
Device: DEF
View device: Device_URL
Role: WINDOWS_SERVER
Time: 14 Aug 2025, 06:05:05
Severity: OK
Priority: LOW
Type: Condition
Status: Triggered
Message: Windows Service: 'Citrix Subscriptions Store (CitrixSubscriptionsStore)' is Stopped at '2025-08-14T05:03:12Z`;

// Regex pattern to extract the device name
var pattern = /Device:\s*(?!View)([A-Za-z0-9_-]+)/;
var match = body.match(pattern);

if (match) {
    var deviceName = match[1]; // Extracted device name

    // Now you can set this value to the CI field. I am logging for testing purposes.
    gs.info(deviceName);
} else {
    // Handle the case where no match is found
    gs.info("No device name found in the incoming text.");
}



Let me know if this helped!

Regards,
Vikas K

0 Helpfuls