Event Field Mapping

Community Alums — Fri, 15 Aug 2025 06:30:50 GMT

I am getting an email in ServiceNow as below:

Organization: XYZ Description: XYZ Jump-box for on-premise Domain controllers Location: Main Office Device: DEF View device: Device_URL Role: WINDOWS_SERVER Time: 14 Aug 2025, 06:05:05 Severity: OK Priority: LOW Type: Condition Status: Triggered Message: Windows Service: 'Citrix Subscriptions Store (CitrixSubscriptionsStore)' is Stopped at '2025-08-14T05:03:12Z

I have an inbound action that will create an event and associate an alert/ Incident to it. I want the CI field on the alert form to be populated with the Device name (DEF) from the email content. How to do this?

What I have done till now -

1. Created event field mapping

2. Pushed the content in payload format in the additional_info field.

3. This works, but the data needs to be in JSON, and the incoming data is in string from mail.

--> Is there a way to use the event mapping for string data and use regex to find the dynamic value after the word 'Device'??

Or any alternate solution to get this done?

Re: Event Field Mapping

VikMach — Fri, 15 Aug 2025 09:01:57 GMT

@Community Alums, you could try something like below.

Also, if there is a scenario where you don't get any device name then you need to update the Regex as well. Just in case if you are getting a different email body.

// var incomingText = email.body_text; // Assuming you're capturing from an email body. For testing purposes I am hardcoding in text format to get the email body as plain text. var body = `Organization: XYZ Description: XYZ Jump-box for on-premise Domain controllers Location: Main Office Device: DEF View device: Device_URL Role: WINDOWS_SERVER Time: 14 Aug 2025, 06:05:05 Severity: OK Priority: LOW Type: Condition Status: Triggered Message: Windows Service: 'Citrix Subscriptions Store (CitrixSubscriptionsStore)' is Stopped at '2025-08-14T05:03:12Z`; // Regex pattern to extract the device name var pattern = /Device:\s*(?!View)([A-Za-z0-9_-]+)/; var match = body.match(pattern); if (match) { var deviceName = match[1]; // Extracted device name // Now you can set this value to the CI field. I am logging for testing purposes. gs.info(deviceName); } else { // Handle the case where no match is found gs.info("No device name found in the incoming text."); }

Let me know if this helped!

Regards,
Vikas K

question Re: Event Field Mapping in Developer forum

Event Field Mapping

Re: Event Field Mapping