How to update Inbound Email and not create a new one with the same condition?

[toulauj]

So this is a scenario, I am trying to create an Inbound Email action for the Windows Server team and they would like for it to create an automated Incident. These are outages and sometimes will have two or three outages email being sent out a night.

I created an Inbound Email that takes a simple condition and creates a Incident on the very first email alert. However, when the same email sends it a second time around, it is creating a new Incident. I would like it to update the current Incident instead of creating a new one. I have tried playing with the "Type" and set it to "Reply" (which does not make sense) on the Inbound Email. I want to know if this is even possible?

I have a Inbound Email that takes email.from.indexOf('TSMSAT01@Brunswick.com') >= 0 for a condition. I would really appreciate if anyone has any idea.

[jshatney]

This is a common problem when trying to use the default Inbound Email action for event related "automated incidents".   The only way you could do this is if there was some sort of ID in the email that was generated that you could check against in your inbound action.

Best practice would be to integrate your event management systems with ServiceNow and let all the events come in and the have someone from operations determine which events are actual Incidents. You can then relate all the other events to specific incidents instead of creating multiple incidents per event.

Integrating Event Management Systems - ServiceNow Wiki

Obviously this will take quite a bit more work, but unless you have some sort of unique identifier coming in from your events emails, they will create duplicates.

[JordanLind · Accepted solution]

Yes this is possible.   Is the sender's email address unique enough to isolate your alerts?   In my example, I'll use the email subject to search for previous email alert within the same day.   If there is an active incident, any additional email will be added as a work note to the first email.   If the incident is not active, a new incident is created.

Type is New Inbound Email action.

//Check for Current Open Incident and Update

var eSubject = email.subject;

var grInc = new GlideRecord('incident');

var grEmail = new GlideRecord('sys_email');

var incUpdated = false;

grEmail.addEncodedQuery('sys_created_onONToday@javascript:gs.daysAgoStart(0)@javascript:gs.daysAgoEnd(0)^subject=' + eSubject);

grEmail.query();

if(grEmail.getRowCount != 0){

  while(grEmail.next() && incUpdated != true){

      grInc.get(grEmail.instance);

    if(grInc.active == true){

    incUpdated = true;

    grInc.work_notes = '\nFrom: ' + email.from + '\nTo: ' + email.to + '\nSubject: ' + email.subject + '\n\n' + email.body_text;

    grInc.update();

    }

  }

}

if(incUpdated == false){

//Creates a new Incident ...

[toulauj]

Thank you so much Jordan! This is exactly what I needed and it worked just like you said. I appreciate the help a lot. I did of course modified the scrip to come from the user instead of using the subject.

[sheths]

Hello, Tou and Jordan,

do we enter the inbound script after  

if(incUpdated == false){

Thank you

Shoaib