Event management Heartbeat ?

[Niuk]

I have some events from critical source posted to ServiceNow event management. What is the best way to create heartbeat incident in case there is no event posted from that source i.e. in last 5 minutes ?

[Ashutosh Munot1]

Hi,

You need to create a schedule job which looks on event table every 5 min. You need to calculate the time between last event from that source till current time. If more that 5mins then create an incident and also in that schedule job you need to check if there is already a incident or not. If yes then dont create the incident.

Thanks,
Ashutosh

[Ryan Zulli]

Hi Niuk,

We would recommend using a Flow instead of a scheduled job - I am in the process of writing up a KB just for this scenario.  The Flow looks something like this ::

only in your case it would run every 5mins - if heartbeat is found, do nothing, if not create an event - then normal event processing takes over and you do what you want with the alert and incident.  This can be expanded to look for multiple heartbeats from various event sources.

hope this helps.

Thanks,

-Ryan

[Maria S]

Hi Ryan 

Can you share some details on how to configure the flow ? Can you share the KB article.

[Ryan Zulli · Accepted solution]

Yes I can post the KB once complete