Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Service Now Incident Filters Overview

 

Junos Space Service Now receives a Juniper Message Bundle (JMB) from a device, when an event occurs on the device, and creates an incident for the event. Starting in Service Now Release 17.1R1, incident filters provide you the option to select JMBs for which incidents can be created at a granular level. For information about incidents, see Incidents Overview.

You can use incident filters for the following purposes:

  • Define the JMBs for which incidents should be created

  • Define the JMBs for which incidents should not be created

Service Now displays all the configured incident filters on the Incident Filters page (Administration > Incident Filters).

When a JMB is received, Service Now applies the incident filter having the highest order, that is order 1, to it. If the JMB matches the term criteria of the filter, Service Now either creates an incident for the JMB or lists the JMB under Suppressed Events depending on the action defined in the filter. If the JMB does not match the term criteria of the filter with order 1, Service Now applies the incident filter with order 2. If the JMB matches the term criteria of the filter with order 2, Service Now creates an incident or lists the JMB under Suppressed Events depending on the action defined in the filter.

Service Now applies all the configured filters in the decreasing order till a match is found and performs the action specified in the matching filter. If no filter matches the JMB, Service Now performs the action defined in the Advanced Filter Settings under Global Settings.

Service Now provides options to define a basic filter or an advanced filter. You can also import filters to Service Now in XML format.

Basic filters filter JMBs based on attributes such as event synopsis, platform, event type and so on by using the and and or predefined computational logic. Advanced filters use Perl script to define the filtering logic and thereby provide the flexibility to define your own filtering logic.

Starting Service Now Release 17.2R1, you can use in-built or custom Perl modules in advanced incident filters. For example, you can use custom Perl module for implementing a filtering logic and use that filtering logic across multiple advanced incident filters.

For using a Perl module, you can store the Perl module (*.pm) in any desired location in the Junos Space server and ensure that the Perl module files have read and executable permissions and are accessible by the advanced filters.

Starting Service Now 17.2R1 release, incident filters are stored at the /var/cache/jboss/sn/advanced_filter location of the Junos Space server.

Note

The Perl module in-built in Service Now includes an API, getExistingIncidents(), for getting information about the latest 20 incidents. The API is included in the FilterUtilV1.pm file stored in /var/cache/jboss/SN/AdvancedFilters. For more information, see Sample Perl Script for Incident and Auto Submit Filters.

Note
  • Incident filters cannot be applied to on-demand JMBs, BIOS JMBs, AIS Health Report JMBs, and Product Health Data JMBs

  • In a Service Now partner, incident filters cannot be applied to JMBs received from a Service Now end customer.

  • There is no limit on the number of filters that can be created. However, a large number of incident filters impacts the performance of Service Now when creating incidents.

Associated Actions

You can perform the following actions related to incident filters:

Release History Table
Release
Description
Starting in Service Now Release 17.1R1, incident filters provide you the option to select JMBs for which incidents can be created at a granular level.