Forum Discussion

teppotahkapaa's avatar
teppotahkapaa
Icon for Expert rankExpert
6 days ago

Sending Sub-ID information into incident integration

When SL1 sends event to, in our case, using SL PF Incindent Sync to ServiceNow, other systems it quite often includes the sub-id information also in that message. Normally that is also used as correlation ID in ServiceNow. Example here what is seen in SN:

So some events utilize other sub-id's than those ootb cpu/mem/disk/etc. 

We would also use that kind of feature in our own event policies to send numeric (or string) information in that field. But we have not yet found a place where we can control that. So how is that information sent to servicenow. What fields in event message are used for that info?

  • justinelborough's avatar
    justinelborough
    Icon for Contributor rankContributor
    6 days ago

    Not sure if this suits your use case,  but we often extract details from the event message using regex groups.  The returned values are used to populate the sub_id field and this is used to then control the uniqueness of the Incident in ServiceNow.

    In the version of the ServiceNow Incident Sync pack we are using (3.0.1), the correlation_id is built in PowerFlow and passed to ServiceNow in the payload. The %Y (sub entity name) runbook variable is used to populate the sub_id value.  Example resulting correlation id below :

    ScienceLogicDev+DEV+783889+EVENT+8185+SUB-ID-dcllnp30_b002;4062078;10/24/2024 11:12:26

    I understand that in later versions of the Incident Sync Pack/Incident Scoped app the correlation id is calculated in ServiceNow so the behavior may differ.