---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Use event input information

# Use event input information {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Use event input information

The Event Input pane in the Event Rule designer helps you reference and use event data when creating or configuring event rules in ServiceNow.
It provides access to event fields, expressions, and raw data to customize alerts effectively.
This pane is visible in most sections of the Event Rule designer except the Event Rule Info section and supports transforming alert content for better incident response.
Show full answer Show less  
ServiceNow recommends using Ignore automation and Enrich automation within Service Operations Workspace as the modern approach to filter irrelevant alerts automatically or standardize alert data for improved handling.

## Key Features

* **Event Input Pane Sections:**
  * *Event Additional Info:* Displays default and custom event fields added to alerts.
  * *Expressions:* Allows creation of expressions from event raw data or additional info to define custom fields.
  * *Event Raw Info:* Always available, showing raw event form fields for transformation.
* **Edit Modes:**
  * *Standard Edit Mode:* Text in the left work area is read-only except for marking and transforming fields.
  * *Regex Edit Mode:* Enables text editing using regular expressions but disables undo and switching back to standard mode.
* **Field Manipulation:** Drag and drop fields or values from the right pane into alert fields on the left to customize content.
* **Expression Creation:** Create new expressions by selecting or defining field names linked to transformed event data.
* **Field Visibility and Order:** Control which fields display using the exclusion list table (\[emeventruleblacklist\]) and reorder fields via the emeventruleorder form.

## Practical Application for ServiceNow Customers

When designing event rules, use the Event Input pane to reference and incorporate relevant event data into alert customizations. Leverage the panes to transform raw event information into meaningful alert fields through expressions and regex editing, enhancing alert specificity and clarity.

Manage field visibility and order to streamline the event rule interface, ensuring only pertinent fields appear during rule configuration.

Adopt Ignore automation and Enrich automation in Service Operations Workspace for automated alert filtering and data enrichment, improving operational efficiency and reducing noise.

## Related Tasks

* Create or edit an event rule
* Configure an event rule to customize alert content
* Filter events that an event rule applies to
* Set thresholds to suppress alert generation  
The Event Input pane that is included in the steps to create an event rule provides a reference to the information that you can use when configuring an event rule. {#event-input-information__ph_MIDWebServerShortDesc}  
Note:  
Use [Ignore automation](https://www.servicenow.com/docs/QdDviJL5PZxXyvuT3BUhuQ "Ignore automation streamlines the process of disregarding irrelevant or false-positive alerts from monitoring systems, efficiently managing alert fatigue by filtering out unnecessary notifications. As a result, teams can prioritize and resolve critical issues more effectively.") and [Enrich automation](https://www.servicenow.com/docs/4GImRp4FbaV8sSboo7rJ7Q "Alert enrichment involves transforming raw events from monitoring tools into a standard format, aiding automated grouping and response. This includes extracting fields from lengthy alert payloads or composing them into a standardized format. Additionally, you can create tags, which are metadata added to alerts for easier filtering and grouping.") in Service Operations Workspace, the updated way to automatically filter out irrelevant alerts, or to transform and standardize alert data for better response.

In the Transform and compose alert output pane, you can also drag the
information into the required fields to customize alert content. The fields in the right-hand
pane appear as a reference to which fields, expressions, and their values are available when
working in the Event Rule designer. The fields that display in the Transform and compose alert
output left-hand workarea become the fields in the generated alert form. In addition, you can
define alert tags that are specific for customization.  
Note:  
Use [Ignore automation](https://www.servicenow.com/docs/QdDviJL5PZxXyvuT3BUhuQ "Ignore automation streamlines the process of disregarding irrelevant or false-positive alerts from monitoring systems, efficiently managing alert fatigue by filtering out unnecessary notifications. As a result, teams can prioritize and resolve critical issues more effectively.") and [Enrich automation](https://www.servicenow.com/docs/4GImRp4FbaV8sSboo7rJ7Q "Alert enrichment involves transforming raw events from monitoring tools into a standard format, aiding automated grouping and response. This includes extracting fields from lengthy alert payloads or composing them into a standardized format. Additionally, you can create tags, which are metadata added to alerts for easier filtering and grouping.") in Service Operations Workspace, the updated way to automatically filter out irrelevant alerts, or to transform and standardize alert data for better response.

## General components and navigation

The Event Input pane consists of these sections:

* Event Additional Info
* Expressions
* Event Raw Info
{#event-input-information__ul_x2d_3y3_wy} The Event Input pane displays in all Event Rule designer sections,
except for the Event Rule Info section. The fields in the right-pane
can be modified only in the Transform and compose alert output section.
In all the other sections, the Event Input pane is read-only and
available for reference purposes.  
Note:  
If Accessibility enabled ![Accessibility enabled]() is selected in System Settings, standard edit mode is not available ![Standard edit mode icon]().

## Edit modes

{#event-input-information__table_d5z_gym_xy__entry__2}

| Mode | Description |
|-|-|
| Standard edit mode ![Event Management icon]() | Text selected in the left-hand workarea cannot be edited. Undo is not available. In this mode, you can only mark the text or values and transform it by selecting a field name. |
| Regex edit mode![Event Management icon]() | Edit text in the left-hand workarea by selecting it, as required. After you have edited the text, you cannot go back to the standard mode. Undo is not available. However, Reset is available, returning the field to its original value. You can compose text using regular expression (regex) format conventions, for example, type (.\*) to create a field name. You cannot use field values like: type "$" to include the value of a field and specify the name of the field in parentheses {}. You can include special characters in a field by "escaping" them, that is, by prefixing the character with a "\\". For example, to include a "\\" in your text, enter "\\\\". |
[ ]

{#event-input-information__table_d5z_gym_xy}

## Event additional info

The Event additional info section displays default event form fields. It also displays fields that were created to display in alerts and that are added to the Additional information section of the alert.
When configuring text in the fields in the left-hand workarea, you can drag field names and/or their value from this section into the fields.

## Expressions

The Expressions section is available only if an additional information field was created.
You can create expressions from event raw data or from additional information data.

1. Click in a field in the Event Input pane to perform transformation actions.
2. Create an expression by transforming information and associating it with a field name. Either select a field name from the suggested list, or create a field name, as required.

3. Click in a field in the Event Input pane. In the left-hand workarea, select the required information.

{#event-input-information__ol_yt3_j3h_1z}

Create expressions by transforming information and associating it with a field name. Select
a field name from the suggested list, or you can create a field name, as required.

## Event raw info

The Event raw info section is always available. Its
contents are the fields from the Event form.
To transform text, click a field in the right-panel to open it in the work area on the left-panel, in the Mark Expressions section. You can select text in the Mark Expressions section where the selected text becomes the value of a newly created field. Name the new field. This new field is added to the Expressions section.  
Note:  
When creating regex expression for input, ensure that you create input with the variables in sequential order. While variables can be skipped for inclusion, the selected order must be maintained.  
Controlling how fields appear:

* Use the exclusion list \[em_event_rule_black_list\] table to hide fields from the right-pane.
* Use the em_event_rule_order form to order the position of each field.
* Fields that are not in the exclusion list and also not part of the em_event_rule_order table still appear in the event rule designer. They appear in the right-panel and in the Transform and Compose Alert Output tab.
{#event-input-information__ul_s2f_cyh_fbb}
**Related tasks**   

* [Create or edit an event rule](https://www.servicenow.com/docs/LO~TxHZ5iImFpp0Q7z71uQ "You can create event rules to generate alerts for tracking and remediation. Use team-based integrations in event rules to make sure that connector ownership and execution of rules give precedence to general rules. Teams can maintain consistency and hierarchy while offering flexibility and customization options.")
* [Configure an event rule to customize alert content](https://www.servicenow.com/docs/Y3NW_Zf4XmGTuFUaeebPHg "You can configure an event rule to customize alert content. You can customize the order of the fields and select which fields display. The fields in the left-hand work area of the Transform and Compose Alert Output section of an event rule are the fields that appear in the generated alert.")
* [Filter the events that an event rule applies to](https://www.servicenow.com/docs/XNAlf~OR1EQYbF40QDJ48g "Define a filter to restrict to which events the event rule must apply. Configure the filter by providing a set of conditions that each event must match to be either excluded or included from applying to the event rule.")
* [Set a threshold to suppress alert generation](https://www.servicenow.com/docs/IAsp2m8pmftrmM_sBGMkOQ "The event threshold is the rate upon which Event Management generates an alert. Receiving multiple events for a device over a short interval may warrant creating an alert, as the condition may be serious. However, receiving events over a longer interval may indicate a less serious situation which would not warrant creating an alert.")