Field mappings for incidents in ServiceNow ITSM


Important

The features and enhancements in this topic are under controlled availability. To use this feature, contact BMC Support. 

Use this topic to learn about the field mappings available for mapping events to incidents and incidents to information events in the solution. 

When you configure Proactive Service Resolution, by default, event fields are mapped to the incident fields. When an event that matches the trigger condition is generated in BMC Helix Operations Management, an incident is automatically created in ServiceNow ITSM. The information in the event flows to the incident based on the fields mapped in the solution.

Important

The minimum required fields for creating an incident are already mapped with default values, and transformation is applied to some of the fields. You can update the existing values or add new fields to be used while creating an incident. An incident gets created or updated based on these values. However, if you are using any custom fields in  or , ensure that you map them based on your environment. 

We recommend that you do not delete any existing field mappings unless specified in the documentation. 

Event to incident field mapping

Consult the following table to learn about the required event-to-incident field mappings: 

Incident field

Event field

Additional conditions

impact

$.event.severity

-

urgency

$.event.priority

-

description

$.event.msg

$.event.msg length less than 4000

short _description

BMC Helix Intelligent Automation Created Incident # $.event_identifier

-

state

$.event.status

-

number

$.event.incident_id

-

sys_id

$.event.incident_sysid

-

cmdb_ci

$.ciItem.sys_id

-

company

$.event.incident_company

$.event.incident_company not empty

category

-

-

called_id

-

-

close_code

Solution provided

$.event.status == CLOSED

assigned_to

-

-

close_notes

BMC Helix Intelligent Automation resolved this incident

$.event.status == CLOSED

correlation_id

$.event.identifier

-

sys_class_name

incident

-

CILookupCriteria

correlation_id STARTS WITH $.event._node_Service_key_mapping

name STARTSWITH $.event.source_hostname

-

assignment_group

-

-

Incident to events field mapping

Consult the following table to learn about the incident-to-information event field mappings:

Event field

Incident field

Additional conditions

msg

Incident Information- $.event.description with incident id - $.event.display_id

-

status

$.event.status

  • $.event.status == 6 maps with CLOSED
  • Default mapping OPEN

severity

INFO

-

_identifier

HD_Ticket_  $.event.ticket_id

-

incident_id

$.event.display_id

-

incident_status

$.event.status

-

incident_priority

$.event.incident_priority

-

source_identifier

ServiceNow Incident

-

incident_relation_source

$.event.correlation_id

-

object

HELIX_IA_PSR

-

details

-

-

component_id

$.event.cmdb_ci

-

incident_sysid

$.event.ticket_id

-

incident_company

$.event.company

-

incident_assignee

$.event.assigned_to

-

incident_submitter

Intelligent Automation

-

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*