Set incident caller from a regex value within an event description.

[Gavin Smith]

We have an event source where users can raise an incident via the in-room vid conferencing units and input their userid. This is included in the description.

The events are processed via the normal event processing and an incident created and assigned to the support team.

By default the incident caller is Event Management. I would like to set this to the userid which I can extract for via regex.

What/where would be the best approach to implement?

Thanks

[Bhuvan]

@Gavin Smith 

Why do you need to change the incident caller field ? Best practices is to set this to 'Event Management' so that when you want to report auto-created incidents from EM, you can use this filter conditions.

If you want to capture user-id information, use any of the event fields and map it to alert and incident. For example, capture the user-id details in description or additional information via regex in event rule 'Transform and Compose Alert Output' section.

If this helped to answer your query, please mark it helpful & accept the solution.

Thanks,

Bhuvan

[Gavin Smith]

My thoughts behind setting to the user was:

- User could see the incident they had raised

- User would get email comms for any updates to the incident.

[Bhuvan]

@Gavin Smith 

Go through below link to understand Alert to Incident process. 

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0756521

Go to Flow Designer and look for flow 'Create Incident' to understand the alert to incident mapping,

I would recommend not to change this mapping and capture the user-id details in description or additional information if it is mandatory. 

If this helped to answer your query, please mark it helpful & accept the solution.

Thanks,

Bhuvan

[Bhuvan]

@Gavin Smith 

Did you get a chance to review this ?

If my response helped to answer your query, please mark it helpful & accept the solution.

Thanks,

Bhuvan