Extract Incident from Email Subject and Add Work Note
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
06-09-2020 02:42 PM
Our goal is to send an email on the fly to the instance, have it parse the INC number from the subject line and add the body of the email to that INC as a work note.
I've created an inbound email action to grab any email with INC??????? in the subject line. I'm struggling to match it to the record. As a result, its creating a new incident. Its also adding it as a customer visible note instead.
Looking for a solution to address one or both of these hurdles! Thank you in advance for reading.
- Labels:
-
Incident Management

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
06-09-2020 03:38 PM
Hello,
Out of box ServiceNow has two methods for associating emails to records. The first of which is by a watermark. Watermarks are placed within outbound emails from SN and are returned in a reply or forward email. The second method, if a watermark is not found, is to look at the in-reply-to header line for a related record (which a lot of email applications don't use, but I wanted to cover that here just in case).
For new emails, there is a catch...there is an OOB inbound action when an email is not a forward or reply and is "net new", it will create a new incident instead (as instructed and defined in the script section). So for your inbound action you've made now...it is most likely with a higher order number than the OOB one and so it's running the OOB one instead.
I would recommend adding a condition statement to your new inbound action and give it more information in the subject line condition (to ensure that an email truly meets this inbound action), set the order number to this to a lower value than most others on this table, and ensure you also check the "stop processing" checkbox.
I'll include an example that I've tested and know works...
So let's say I have an incident already numbered INC0010020 and I want to send a brand new email to ServiceNow to add some work notes to it. So this isn't a reply....this isn't a forward, just a brand new email. I know this email always uses the format where the INC record number is the very last thing in the email. So for example...the subject says: "this is a test INC0010020".
I'll create an Inbound Action with settings like so:
With script in the "Actions" tab like so:
var subject = email.subject;
var n = subject.split(" ");
var gr = new GlideRecord('incident');
gr.addQuery('number', n[n.length - 1]);
gr.query();
if (gr.next()) {
gr.work_notes = email.body_text;
gr.update();
}
So this will pull the INC number from the subject, query the incident table and look for a number related to that, and then update the work notes. So we're sort of loopholing the whole "new" email, finding the match, updating that match, but then stopping it where a normal new email would create a brand new record.
Also, here's documentation to help: https://docs.servicenow.com/bundle/orlando-servicenow-platform/page/administer/notification/concept/...
Please mark reply as Helpful/Correct, if applicable. Thanks!
Please consider marking my reply as Helpful and/or Accept Solution, if applicable. Thanks!

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
09-22-2021 12:54 PM
Hi
It's been over a year (haha) and so I wanted to check-in on this.
If my reply above helped guide you Correctly, please mark as Correct.
Thanks!
Please consider marking my reply as Helpful and/or Accept Solution, if applicable. Thanks!