We're usign the SolarWinds plugin for ServiceNow to allow SolarWinds to create/update incidents. This is working fine except for one piece. Our struggle is that some incidents are being re-opened almost immediately after we resolve them. There is a (5 minute?) timer quirk that can happen when: * Incident is resolved in ServiceNow * ServiceNow checks with SolarWinds. * SolarWinds alert may still be active b/c its 5 minute polling interval has not occurred * So, ServiceNow re-opens incident that we had just recently resolved. Is there a way to modify the integration behavior to avoid this or do we need to change our procedures? Having agents clear the alert first in SolarWinds then resolve the incident seems like extra unnecessary work. Unless someone can confidently tell me that's the way it has to be, we're still holding out hope.

Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

SolarWinds is re-opening my ServiceNow incidents too quickly

We're usign the SolarWinds plugin for ServiceNow to allow SolarWinds to create/update incidents. This is working fine except for one piece. Our struggle is that some incidents are being re-opened almost immediately after we resolve them. There is a (5 minute?) timer quirk that can happen when:

Incident is resolved in ServiceNow
ServiceNow checks with SolarWinds.
SolarWinds alert may still be active b/c its 5 minute polling interval has not occurred
So, ServiceNow re-opens incident that we had just recently resolved.

Is there a way to modify the integration behavior to avoid this or do we need to change our procedures? Having agents clear the alert first in SolarWinds then resolve the incident seems like extra unnecessary work. Unless someone can confidently tell me that's the way it has to be, we're still holding out hope.

Find more posts tagged with

Accepted answers

rschofield

Great timing shooty. We implemented a solution. We built a custom API call that clears the alert when the user resolves the incident in ServiceNow. This is triggered from ServiceNow.

All comments

Shooty

Same issue here ServiceNow and Orion alerts - Alert Lab - The Orion Platform - THWACK (solarwinds.com)

rschofield

Great timing shooty. We implemented a solution. We built a custom API call that clears the alert when the user resolves the incident in ServiceNow. This is triggered from ServiceNow.

Shooty

Thats great news, would you be able to provide more technical specifics on how this is done and configured? Perhaps you can message me some additional details?

rschofield

Within ServiceNow, we created a flow action that is triggered by a business rule.

The Business Rule runs before update when the State changes to 'Resolved' and only for the SolarWinds-generated incidents. It also adds work notes to the incident when the Flow Action is completed.

For the Flow Action:

1. Make a REST call to GET the Alert ID for the associated incident. The ServiceNow admin will need the query statement that the SolarWinds admin will need to provide. Meaning SolarWinds admin gives the ServiceNow admin the query in SQL (or is it SWQL?).

2. Make a REST call to POST back to SolarWinds. The resource path will call the 'ClearAlert' function and provide the Alert ID received in the previous step.