Alert Management Rule not executing after executed for once

gaurav72 · ‎08-26-2022

I wanted to execute alert management rule to run a subflow whenever I receive a new event for an alert. I have provided below conditions but it is not triggering after one time unless alert is closed and re-opened again.

Is it mandatory for an alert to close and open in order to execute alert management rule again?

Any suggestions will be helpful to achieve requirement to trigger subflow as when we receive new event which is mapped to an alert.

Harneet Sital · ‎08-26-2022

Hi @gaurav72

As per the definition of 'Rule is activated when' field on your alert rule -

Rule execution takes place when:

Alert changes to filter (this is your current value) – content changes to the alert cause the alert to match the filter. If the filter is matched on the following update of the alert, the rule is not applied. If the alert was closed and then reopens, at the next update of the alert and the filter is matched, the rule is applied. Thereafter, when there is an update of the alert, the rule is no longer applied.
Alert matches filter – the content of the alert matches the filter. On the following update of the alert and if the filter is matched, the rule runs and is applied to the alert. The rule remains applied for every matching update.

Do you see a way you can move this to the second type of rule execution may be using related list conditions somehow?

Thanks
-Harneet Sital
Request you to please mark my answer as helpful or correct based on the impact
Find all my ServiceNow articles here

View solution in original post

Harneet Sital · ‎08-31-2022

Hi @gaurav72 does the above help or do you need further help to close the issue?

gaurav72 · ‎09-02-2022

Thank you so much for your answer.
I was able to use Alert matches the filter option and restricted any other updates to alert directly via subflow so it was triggered when I had new events.

Denise Taylor2 · ‎08-30-2023

Harneet,

I have a similar situation but cannot determine a alert management rule filter that will isolate event-only changes to an alert. I want to create a BR that fires when alert.event_count changes and then call the subflow from script as you are suggesting. However, I can't figure out a way to tie back in the alert execution (ie. em_alert_management_execution).

Do you have any example code of how to call a subflow from a BR and have it mimic the same results as an alert management rule (ie. show the subflow execution context in the related list of the alert)?