Alert Management - Create Incident on Impacted Services

[Henrik Jutterst]

Need some guiding here...

In the Alert created from an Event, I see the host name in the Configuration Item field. I need to create an incident, but not on the Server of the Alert, but on the support_group of the Impacted Services.

How is that done? I have the Impacted Service on the Alert, shown below. 

[Rahul Priyadars]

In My view - You can do a topup customization for populating Services Field in Incident form - based on CI on which event arrived. You need to traverse the tree UP from Server to Services and populate it.

Regards

RP

[Henrik Jutterst]

Hi Rahul and thanks for input!

I see what you're saying, but the solution sounds a bit odd, if you mind me for saying so. I have the impacted service on the Alert, so I was hoping to find an easy way to create the INC on the service by having all the data displayed on the Alert record.

Create an incident on impacted service shouldn't be that big of a deal, at least to my ears.

I mean, I can look in cmdb_rel_ci table and query the service based on host, but it sounds a bit like bad practice.

Anyone else with an idea here?

[Henrik Jutterst]

Hoping to find some OOB function that I'm missing. There must be something, right?

[Henrik Jutterst · Accepted solution]

I got this answer from Hi, so I'm marking this as the correct solution even though I was hoping there was a OOB function for things like this where CSDM and the whole Service concept is so in focus now.

If you ask me, I think this is a huge thumbs down and something that should be implemented ASAP. I do not want to go in and modify OOB Script Include because there is no way to create an incident on the related Application Service. 

Solution Proposed:
You can customize the created incident using the

EvtMgmtCustomIncidentPopulator.populateFieldsFromAlert

script include. The customization includes mapping fields from the alert to the incident or aborting the incident creation according to customized conditions. For more information, see Custom alert fields.

https://docs.servicenow.com/bundle/quebec-it-operations-management/page/product/event-management/tas...