Incomming events are missing value in Severity field - how do I set the value - via Event Rules??

[JanneHjorth]

Hi all.

I'm new to Event Management and at the moment we experience incomming events, where Severity field is empty. So no alerts are created. I have this record:

How can I set a value in Severity field and secure the creation of alerts??

I really need a helping hand here - thanks in advance.

Regards, 

Janne

[JanneHjorth]

Thanks for this information Dom 🙂

Regards, 

Janne

[dbehnood]

No worries Janne. How are the Events getting inserted (webservices/https, email, snmp trap)?

[JanneHjorth]

The events are inserted via Webservice.

[patrickkenney]

You can begin by reviewing the Event Rules documentation here: https://docs.servicenow.com/bundle/paris-it-operations-management/page/product/event-management/concept/create-event-rules.html

It looks like you already have an Event Rule called "Umon_missingSeverity". In this rule you can set the severity to a fixed value. If you will have events that arrive with different text in the description that indicates severity then you would need an Event Rule for each scenario.

1. Using the description text it states "Status is Critical". Add a line of filtering to look for a Description that contains "Status is Critical".

2. In the Transform section of this rule add a Severity value 0-5 in the Severity field.

Given the format of your description and the lack of a Severity value being passed with the event, you will need an event rule for each severity because of the need to match the text each event to determine severity.

[JanneHjorth]

Hi Patrick.

Thank you for the answer.

I've tried to make an Event Rule, where I set the Severity value - but it doesn't work.
In the "Transform and Compose Alert Output" I've tried to set the Severity value like this:

Is there another way??

Regards Janne