Inbound Action - Preventing ticket creation for duplicate emails received

[SteveS]

I am trying to find out how I could prevent a ticket's creation for duplicate emails received. We only have one inbound action that will create a new incident when a email is received from a certain email address (a server) with a specific subject/body. The problem is that sometimes we receive 2-3 duplicate emails milliseconds (possibly seconds) apart from each other from this certain email address (a server) which would cause a ticket to be created for each email.

I would like to prevent a duplicate ticket from being created if there is already one that was just opened. Any help would be greatly appreciated

[lesleymills]

Sorry I didn't realise you could take old comments and repost them. It seemed strange that I posted my comment in January 2013 and someone back in August 2011 posted a reply.

Your code was very helpful and addressed half of the problem at hand ie duplicate emails, the other issue was duplicate calls logged by users using the quick call function to create incidents.

We looked seriously at your code but decided that for things like password resets, several users may send in exactly the same short description ie 'please reset my password' and we didn't want to append these separate requests to the one request, this was too risky and too likely to happen. We then thought about reducing the timing from 72hrs to 4hrs and adding the user details such that the user and short description would have to be the same and the email would be checked against all emails received in the last 4hrs. (We don't get many users sharing request for service emails and then replying all so other users logging the same incident is highly unlikely here.) However this was all getting too hard for us to code and we're in the middle of more urgent configurations and readying ourselves for an upgrade to Berlin and so this went in to the too hard basket.
Thanks again but we may ask our ServiceNow provider to code this for us as I think this is way above our abilities.

[Dinga]

Well, if it helps any and you have the time and interest in playing, below is the final script that I used. It may provide a better example of how I utilized it within our environment. Basically I identified a handful of "spammy" email addresses that are specific to internal operations; the intent was that if an operations job failed and an automated notification was sent, we wanted the server to keep sending the paging notifications to the appropriate techs but not create a new incident in Service-Now each time. So *only* if the inbound email address is any of those listed at the top of the function, it will search all active incidents for ones that already exist with a duplicate email subject / short description. That aspect removes the possibility of inadvertently skipping past a legitimate email from an end user.

function passesEmailConditions(email) {
//answer=true means we should create a new incident; this is the default
//answer=false means this is a duplicate and should not be created again
var answer = true;
if ((email.from == "xxxxxx6@spectrumbrands.com") || (email.from == "sxxxxx1@spectrumbrands.com") ||
(email.from == "axxxxx1@spectrumbrands.com") || (email.from == "axxxxx2@spectrumbrands.com") ||
(email.from == "cxxxxx1@spectrumbrands.com"))

{
var gr = new GlideRecord('incident');
gr.addQuery('state', 2); // 2 = Active, 1 = New, 6 = Resolved, 7 = Closed
gr.addQuery('short_description', email.subject);
gr.query();
if (gr.next())
{
gs.log(gr.number + ' is a duplicate issue of: ' + email.subject);
answer = false;
}
else
{
answer = true;
}
}

return answer;
}


To make use of this business rule, all I've done is gone into the Inbound Email Actions and entered it as a condition for the Create Incident function: passesEmailConditions(email)

As as for the other threads/replies/etc - I think that either the board is automatically merging some of these threads or perhaps a moderator is doing so. My past comments that are appearing on this thread were originally a single thread of their own that I don't believe I ever got a response on besides my own; I never copied/pasted them to this specific thread or anything.

Anyway, hope it helps - I can try to provide additional details if you need any.

[lesleymills]

Thanks for this, the script makes sense and unlike some I've seen is nicely commented so a dummy like me can get what its doing.

[ddiroma]

This was a great help. I found the post you were referring. I added/changed what you wrote a little bit as I was still having an issue where replies or forwards were still creating duplicate issues. I don't know if there is a better way to do this, but I tried a number of different ways with no luck and didn't find anything else on the community.

var IncidentMatchQuery = new GlideRecord('incident');

//next two lines remove the first 4 characters of the email subject and create a variable to go into query to ignore replies or forwards

var description = email.subject + " - " + email.origemail;

var nore = description.slice(4);

//Query the short description to look to see if the email subject and person sending the email are found in an incident. For example Test - Dion DiRoma

IncidentMatchQuery.addQuery('short_description', 'CONTAINS', nore);

IncidentMatchQuery.query();

var incCount = IncidentMatchQuery.getRowCount();

if (incCount == 0 ) {

// if no matching record is found then insert a new incident record with the email otherwise leave it

current.comments = "Sent by: " + email.origemail + "\n\n" + email.body_text;

current.short_description = email.subject + " - " + email.origemail;

current.contact_type = "email";

current.u_category_tier_1 = "Software";

current.u_category_tier_2 = "Hyperion Financial Management (HFM)";

current.u_incident_type = "Failure";

current.incident_state = 2;

// current.notify = 2;

current.impact = 4;

current.urgency = 3;

current.assignment_group = 'fc5b5c9f37d112006983fa7b34990e0c';          

current.caller_id = email.from;

current.u_impacted_user = email.from;

current.insert();

}

[itsmdevops]

Hello Steve, we'd like to check if you are able to setup your inbound action: create incident and get it work? We have the same requirements to ignore the same email if found to be identical subject and email content.

Please advise

Thank you