Event Management rule for COUNT <= X

[ChristianDE]

Hi All,

I am looking for some help in defining our event management rule for a very specific use case. Basically we get events pushed into ServiceNow every 2-3 seconds or so which we call Heartbeats. They are there to tell us that our devices that we monitor are still alive.

We need to define a rule to create an Alert and the also an Incident if we are not getting not getting a certain number of heartbeats in a set amount of time. With the current threshold setting I can only define the number of heartbeats I get but not the once I don't get. If we use the LESS THAN then we need a numeric value from a field, but we don't have a field that has the count of heartbeats per minute.

Any idea who we can potentially create n event rule that would look for e.g. LESS THAN 20 events in 60 seconds and then create Alerts and if it is more than 20 Events to ignore them?

Thanks in advance.

[Ryan Zulli]

Hi Christian,

  I've developed a similar solution using a flow in Flow Designer, here is a snippet, let me know if this gets you closer to your usecase otherwise we can talk further ::

https://www.servicenow.com/community/itom-forum/event-management-heartbeat/m-p/903354

Thanks,

-Ryan

[ChristianDE]

Hi Ryan,

Thanks for your response. Yes this looks exactly like what we are trying to achieve. Initially I though we use Event rules to create a rule ignore normal heartbeats, but looking at your suggestion, it seems we can out it all in one Flow Designer flow, to only create alerts when we don't hear anything back from our critical devices.

Would it be possible to share some more details on your solution? You referenced a KB article with more details but I'm unable to locate one.

Thanks again for sharing.

Regards,

Christian