Service Now Incidents

Dashboard Server
1

Trying to pull all Incidents from Service Now via the Web API that is NOT closed.

I know that Squared Up KB regarding Service Now states that you should used Sysparm_query “Active=True” for open incidents and “Active=False” for closed one. However, this doesn’t work.

When copying a Query from Service Now filter I can see that Resolved and Closed has a value of “state= 6” and “state=7”
Using this in a sysparm_query doesn’t work. sysparm_query state=6 (for instance) or if you want to use NOT !=6 (for instance for open incidents)

Anyone who’s been successful with this?

2

I had this a while ago and I found that the query is case sensitive so if you’re using “Active=True” per your description, vs “active=true”, ServiceNow will ignore that part of your query and return everything.

1 Like
3

My bad. I’m using ‘active=true’ (not what I wrote in the post)
However, I get all alerts when using ‘active=true’. Not only open ones.

4

Do you mind sharing your queries?

5

Sure.

On a WebAPI Grid tile, through the http mode pane I’m adding table/incident to my base URL, then under the headers & data pane I’m adding a couple of entries to data for;

sysparm_fields state,caller_id,short_description,priority,number,assigned_to

sysparm_query cmdb_ci.name={{displayName}}^active=true

Note this is for a perspective hence adding the variable {{displayName}} moustache.

If I change true to false, the table shows only Closed incidents, and with it set to true i’m getting only Open\On-Hold etc incidents.

6

I grabbed this one from SQUP support a while back, asset details, created against the Windows Computer class. table/cmdb_ci_server / sysparm_query name={{displayName}} / sysparm_fields asset,os_version,operational_status,assigned_to,subcategory,sys_id / sysparm_display_value true / sysparm_limit 10 - Did require that I allowed access to that table in SNOW too.

7

Hi

It worked when I used the sysparm_query on the same row {{displayName}}^active=true
Previously I had divided it so I used sysparm_query active=true on a separate line.

Thanks ARMless and thanks Jelly for the Asset info

SCOM-SQL-Queries-Kevin-Holman.zip (1.7 KB)