ServiceNow Event Management: Mapping Service Offering from Dynatrace Event Additional Information to

thoshino12
Tera Contributor

yesterday

We are currently using ServiceNow Event Management integrated with Dynatrace.

When Dynatrace generates an event, the Service Offering information is included in the Event’s Additional Information field.

Our goal is to extract the Service Offering value from Additional Information and automatically populate the Service Offering field on the Incident when an Alert is created and an Incident is subsequently generated.

Based on our understanding, the recommended approach would be to use Event Rules together with Event Field Mapping. Could you please confirm whether this is the appropriate best-practice approach?

The Service Offering name is included in the Additional Information field as a JSON string, for example:

JSON

"flattened.dt.host_group.id.0": "Service Offering Name"

We configured the input method for Event Field Mapping as described below.

We also created the following Event Field Mapping, but it does not appear to be working correctly. Could you please review the configuration and advise where the issue may be?

 

thoshino12_0-1785990568337.png

 

0 Helpfuls
  • 109 Views
1 REPLY 1

vaishali231
Kilo Sage

yesterday

Hey @thoshino12 


Yes, Event Rules with Event Field Mapping is the recommended and supported approach for this use case. However, there are a few things worth verifying in your configuration.

From your example, the value is stored in the Additional Information JSON as:

{

  "flattened.dt.host_group.id.0": "Service Offering Name"

}

A few checks I'd recommend:

Verify that the incoming Event actually contains the key flattened.dt.host_group.id.0 in the Additional Information field.

Ensure the Event Rule is matching and executing before the Alert is created.

 

 

If Service Offering is a reference field, confirm that the incoming value matches an existing Service Offering record (or map the corresponding sys_id instead of the display value).

Verify that the Alert-to-Incident field mapping also includes the Service Offering field, otherwise the value may populate on the Alert but not on the Incident.

From the screenshot, it also looks like the mapping is using additional_info as the source value. If the JSON needs to be parsed to retrieve a specific key, this may not resolve the value as expected. In those cases,   Script Include to parse the JSON and explicitly set the Service Offering is often a more reliable approach.

 

***********************************************************************************************************************************

If this response helps, please mark it as Accept as Solution and Helpful.

Doing so helps others in the community and encourages me to keep contributing.

Regards

Vaishali Singh

Servicenow Developer
Linkedin - https://www.linkedin.com/in/vaishali-singh-2273361bb