Event management Heartbeat ?

Niuk
Mega Contributor

I have some events from critical source posted to ServiceNow event management. What is the best way to create heartbeat incident in case there is no event posted from that source i.e. in last 5 minutes ?

1 ACCEPTED SOLUTION

Ryan Zulli
ServiceNow Employee
ServiceNow Employee

Yes I can post the KB once complete

View solution in original post

7 REPLIES 7

Ashutosh Munot1
Kilo Patron
Kilo Patron

Hi,

You need to create a schedule job which looks on event table every 5 min. You need to calculate the time between last event from that source till current time. If more that 5mins then create an incident and also in that schedule job you need to check if there is already a incident or not. If yes then dont create the incident.

Thanks,
Ashutosh

Ryan Zulli
ServiceNow Employee
ServiceNow Employee

Hi Niuk,

We would recommend using a Flow instead of a scheduled job - I am in the process of writing up a KB just for this scenario.  The Flow looks something like this ::

find_real_file.png

only in your case it would run every 5mins - if heartbeat is found, do nothing, if not create an event - then normal event processing takes over and you do what you want with the alert and incident.  This can be expanded to look for multiple heartbeats from various event sources.

hope this helps.

Thanks,

-Ryan

Maria S
Kilo Contributor

Hi Ryan 

 

Can you share some details on how to configure the flow ? Can you share the KB article.

Ryan Zulli
ServiceNow Employee
ServiceNow Employee

Yes I can post the KB once complete