Bidirectional ticketing is not working as expected

Applicability

Description

The Bidirectional Ticketing(BDT) is integrated with ServiceNow in IT Service Intelligence (ITSI) is not working as expected.While the system can successfully create incidents in ServiceNow, the expected behavior of BDT does not happen.

Specifically, when an episode is manually resolved in ServiceNow,

The NEAP policy with the action rule fails to close the episode, and the changes are not reflected in ITSI.

Investigation

A detailed review of the itsi_grouped_alerts, specifically for that event ID revealed a mismatch in the policy IDs used by two sources: test policy and default policy. Ideally, the policy IDs for both sources should be the same, ensuring proper alignment.

However, in this issue, the policy IDs were different. Further validation was carried out by reviewing engine logs confirmed that event was not grouped under the same policy ID.

In the Further Investigation on the itsi_grouped_alerts for the that event ID. It is confirmed that the ticket_system was custom(GSN) , which contributed to the failure in closing the episode in ITSI.


The Bidirectional Ticketing functionality will not work with custom ticket_system name(GSN).

Resolution

To resolve the issue with bidirectional ticketing (BDT) functionality between ITSI and Service Now, it was recommended that the "ticket_system_name" field in the custom alert_action configuration should be updated.

Specifically, In splunk/etc/apps/SA-ITOA/local/notable_event_actions.conf, in the [custom alert_action] stanza, the "ticket_system_name" name should be set to "Service Now" or to any other Out of the box supported ticket management system in order to ensure proper support for BDT integration. 

This update is crucial for aligning the custom alert actions with Service Now, enabling the bidirectional ticketing functionality to work as intended and allowing for seamless episode closure in ITSI.