How to Update existing Incident?

[Sontel]

Hello Everyone!!! I need your guidance with one of the requirement.

I've created an inbound action to create Incident for the Server Down notifications received from WhatsUp Gold tool. Is there any way I can update the existing incident when a particular Server comes up and SN gets an Up notification. I would Like to append the description and change the Incident status to pending or close upon identifying that the server is up.

Here is the notification format.

Subject: Down notification--> Windows Server is Down at least 5 min (xxxxx004.eu.abc..intra).

Up notification --> Windows Server is Up at least 5 min (xxxxx004.eu.abc..intra).

Description : Ping is Down/Up at least 5 min on Windows Server: xxxxx004.eu.abc..intra (10.20.30.40).

Details:
Monitors that are down include: Ping

Monitors that are up include:

Notes on this device (from device property page):
This device was scanned by discovery on 4/18/2018 11:27:47 AM.

----------------------------------------
This mail was sent on August 08, 2018 at 11:31:22
Ipswitch WhatsUp Gold

[LisaKomidar]

When you want to do a bidirectional conversation with ServiceNow and another system, you need to be able to send back to the other system some sort of unique identifier so any additional calls can align it.  I would recommend that you send the incident number or sys_id.  Then when you make the UP call back to the incident, you can query the incident table for the number or sys_id.  You can also store some information in ServiceNow to help as well.  We have an "Alert Alias" on our incident table that gets updated with the alert ID from our other system since it is easy for us to do the query within ServiceNow.  When a call comes into the system, we first look at the alert id and see if it matches to an incident.u_alert_alias value.  If it does, we process the alert within the matching incident.

Lisa

[gauravgurbani7]

If you are recieving the Up message in the form of mail using inbound Action you can do this

1) first on creation of incident you should send some unique number or sysid to snow you have one custom field on incident form as supplier number .

2) then for up message it should include the sysid or number either in Subject or in the body of the email to identify which incident needs to be updated in snow which has same supplier number.

3) Inbound Action for update will get the number either from subject or mail body after identification of that through inbound script update the record of incident.

[Sandeep Kumar6 · Accepted solution]

Hi Sonesh,

I understood your requirement!

You created Incident based on the Incoming notification from Tool so 

Now my question is to you are you sending some identification to WhatsUp Gold tool or any identifier?

If yes then when your Server is UP that time you send that Incident No or unique Identifier back to ServiceNow.

                     -->  Once you receive Up notification with Incident No then you can query Incident table and update the existing one. 

If No then you need to send incident number or any unique identifier to WhatsUp Gold tool while creating Incident.

Another Way is:

If you need to do this, you could create a custom field with the old ticket number, or even prefix the short description with it.  

Then your inbound email script could do a query in whatever field you choose to match that ticket number.  

First you could need to parse the email subject for the old ticket number, then use that in your query to find the existing incident created.   I hope this makes sense

https://community.servicenow.com/community?id=community_question&sys_id=ed025feddbdcdbc01dcaf3231f9619ce

If my answer helped  you then please hit like or mark as answer.

Thanks

SAndeep

[Sontel]

Thanks to all of you, I got your points you meant to communicate to me. I've noted those things you mentioned and will start working on it. Will let you know in case I will run into any issue related to this thread. Thanks for the Guidance.

Happy Knowledge Sharing 🙂