How to change the state of event to ignored in Event Mangement

[Community Alums]

Hi,

Could you please help how can we change the state of event to Ignored instead of processing when Ignore Event rule is applied

We generally create an ignore event rule by selecting 'Ignore event that matches this filter' in Event filter but could see the state of an event to 'Processing' which it will not create an alert as ignored event rule is applied  to avoid noise

But we need the state of event to ignored instead of processing in that scenario not sure which stage the event state changes to ignored

Please find the below detailed description why we are checking this scenario to change the state of event to ignored

Detailed description

Alerts coming from different sources, which are not related to any Configuration Item.

This causes Service Now to capture the 'node' field of the alert and consider it an 'object' towards the licenses count.

How are the licenses are counted, so we have gone through this KB Article

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1000863#mcetoc_1fmdri78e132

For alerts not binding to a CI, we performed changes in our Event Rules which fixed this issue.

How long until those unresolved objects for licensing disappear from the table em_unique_nodes as 'Type == Unknown' ?

Additionally, events that do not get promoted to the Alert stage will not update the License Usage, effectively ignoring sources for licensing whose events are ignored. So the event 'State' has to be 'Ignored'? Or the event State can be 'Processed' and do not generate an alert? (via event rule dropping/ignore the event on the filter)

[Harneet Sital · Accepted solution]

Hi Dhana, 

First thing, if there is no licensing cost added if the alert is not created from the event. Confirmed in the same article you posted - 'Additionally, events that do not get promoted to the Alert stage will not update the License Usage, effectively ignoring sources for licensing whose events are ignored.'

For the state change, if it's not marking the state as 'ignored' and keeping it as processing, you can write a scheduled job to mark these records as ignored if the records have been created with the same filter and are in processing state say for more than 8 hours. 

Hope this helps, let me know if you have any further questions, please. 

Thanks, 
Harneet