ServiceNow Event Management: tracing back the impacted services from the incident and alert

 

Tracing impacted services:

 

I checked and total impacted on the incident description comes from the alert management rule:

 

 

(BTW Here’s an interesting KB, it’s maybe worth clicking the ‘refresh impacted services’ button from the CI to see what happens https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0856121 )

 

The inputs impactedServicesList seems to be calculated from the incoming alert

The CI as recorded on the incident description is: prdatl01acXXXX

Mapped from the Alert:

You can view its relationships on this record:

https://xxxxx.service-now.com/nav_to.do?uri=cmdb_ci_linux_server.do?sys_id=424212ed1b05b8907bdaddf0b24xxxx

 

I’ve located the code for the impactedServices calculation and it’s out of the box:

 

(function execute(inputs, outputs) {

    if (inputs.impactedServicesList){

        var impactedServicesArr = inputs.impactedServicesList.split(",");

        for (var i=0; i<impactedServicesArr.length; i++){

            var gr = new GlideRecord("task_cmdb_ci_service");

            gr.initialize();

            gr.setValue("cmdb_ci_service", impactedServicesArr[i]);

            gr.setValue("task", inputs.taskGr.getUniqueValue());

            gr.setValue("manually_added", false);

            gr.insert();

        }

    }

})(inputs, outputs);

 

Looks like the purpose of the code is to create task_cmdb_ci_service entries against the incident

This above code seems to match the following list:

 

https://xxxx.service-now.com/task_cmdb_ci_service_list.do?sysparm_query=manually_added!%3Dtrue%5Etask%3D0b33fbce1b4d8d107bdaddf0b24xxxx&sysparm_view=

 

all of these 166 entries are mapped application services so you can click into them to see how it relates to the configuration item

one such example from the “view map” button:

 (ServiceNow )