Closing bulk incidents

[rohit231]

Hi,

I have configured the service-now for creating incidents based on inbound emails and it is working fine.
I am looking for a way in which i will be able to close n-number of incidents with same reason ( coz at times we get repetitive alerts and closing each ticket 1 by 1 is tedious task)

Also is there a way in which i will be able to stop the creation of incidents, if the same incident is created from an inbound email 5 minutes ago.

This will help me to stop creation of unwanted incidents or repetitive incidents.

Thanks,
Rohit

[gflewis]

We had the same problem. Our monitoring software would occasionally generate a bunch of redundant incident tickets, and we needed an easy way to close them in bulk. We solved the problem as follows.

We created a Incident UI Action called "Resolve Monitor Event". The UI Action is only available for List Context Menu and List Choice. It allows a support person to bring up a list of incidents assigned to his/her group, click the check boxes, and then select "Resolve Monitor Event" from "Actions on selected rows". There are various conditions built into the UI Action to prevent abuse. For example, the UI Action only works on incidents that were opened by the monitoring system and that are assigned to your support group. We defined a special Close Code which is only used for incidents closed by this UI Action.

At first I was trying to figure out how to allow the user to enter Close Notes for the incident tickets because we require Close Notes as a mandatory field when resolving an incident. Then I realized that there was, in fact, no such requirement. The UI Action is only used for one purpose: to resolve redundant tickets created by monitoring software. Thus, the Close Notes would always be the same. If Close Notes are required then they can be hard coded in the UI Action.

One of the great things about this solution is the unique Close Code, which makes it simple for us to run reports to see how often feature is being used.

[sagarb]

Have you wrote any script in UI action? If yes can you please share?

[Jay_Ford]

We have the same setup with some alerts that come from some of our application monitoring. You can filter the inbound email s but there has to be something common about them to be able to pick them out of the crowd. For example, in the code below we query the incident table to see if an incident from the user is open with the same short description as the inbound email. If we don't find a match we create the incident, if we find a match then we just update the existing incident.

var count = 0;
var inc = new GlideRecord('incident');
inc.addQuery('active', 'true');
inc.addQuery('incident_state', '!=', '11');
inc.addQuery('opened_by', email.from);
inc.addQuery('short_description', email.subject);
inc.query();
while (inc.next()) {
    inc.work_notes = 'Duplicate ' + email.subject + '\n\n' + email.body_text;
    inc.update();
    count++;
}

if (count == 0) {
//run your code to create a new incident because this one isn't a duplicate
}