Werk #19769: ServiceNow notification plugin: filter the issue lookup query
| Component | Notifications | ||||||
| Title | ServiceNow notification plugin: filter the issue lookup query | ||||||
| Date | May 8, 2026 | ||||||
| Level | Trivial Change | ||||||
| Class | New Feature | ||||||
| Compatibility | Incompatible - Manual interaction might be required | ||||||
| Checkmk versions & editions |
|
When a Checkmk notification fires, the ServiceNow plugin first looks up whether an issue (incident or case) for the given Checkmk problem ID already exists. On large ServiceNow instances this lookup can run over the entire incident or case table and time out, because it is filtered only by the Checkmk problem ID encoded in the work notes.
A new optional parameter Additional query filters has been added below the Use site ID prefix field. It accepts a list of name/value pairs that are AND-combined onto the ServiceNow sysparm_query used during the lookup, e.g. company=<sys_id> or assignment_group=<sys_id>. This narrows the search to the scope managed by Checkmk and avoids the timeouts.
The same notification macros that are available in Custom fields can also be used in the filter values.
To keep the lookup symmetric, the configured name/value pairs are also written to the issue at creation time. Recovery, acknowledgement and downtime notifications therefore reliably find the previously created issue without any additional configuration in Custom fields.
Incompatibility — migration of existing open issues: open ServiceNow issues created before the filter was activated do not carry the filter fields. After enabling Additional query filters the lookup will no longer find them, so recovery, acknowledgement and downtime notifications for those legacy issues will fail with "No related open issue could be found".
Before activating the filter, drain or backfill the still-open Checkmk issues. A ServiceNow Background Script that updates every open issue whose work notes contain Check_MK Problem ID: with the same field/value pairs is sufficient, e.g.
var gr = new GlideRecord('incident');
gr.addQuery('active', true);
gr.addQuery('work_notes', 'CONTAINS', 'Check_MK Problem ID:');
gr.query();
while (gr.next()) {
gr.company = '<sys_id>';
gr.update();
}
Alternatively, close the affected issues manually. Once all pre-existing issues are drained, no further action is needed.