{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":30611,"path":"it-operations-management/event-management/t_EMCreateEventFieldMapping2.md","title":"Create event field mappings","bundle":null,"doc_type":null,"release":"australia","body":"\n# Create event field mappings\n\nUse event field mappings to map values from specific event fields to values in other fields to provide more comprehensive information in an alert. Use team-based integrations in event rules to make sure that connector ownership and execution of rules give precedence to global rules. Teams can maintain consistency and hierarchy while offering flexibility and customization options.\n\n## Before you begin\n\nRole required: evt\\_mgmt\\_admin\n\n## About this task\n\nCreate the rule to match the event by its class and original values. Also, specify the new values to replace the original values in the event.\n\nFor users familiar with the classic Event Management experience, enrich automations create event rules but with an easier interface and with better team support. For more information, see [Create Enrich automation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/enrich-alert-sow-itom.md).\n\n## Procedure\n\n1.  Navigate to **All** &gt; **Event Management** &gt; **Rules** &gt; **Event Field Mapping**.\n\n2.  Select **New** or open an existing rule to edit and fill in the fields.\n\n    \\[Omitted image \"event-mapping-rule.png\"\\] Alt text: Event field mapping\n\n<table id=\"table_EventFieldMappingForm\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nName\n\n</td><td>\n\nEvent field mapping name.\n\n</td></tr><tr><td>\n\nSource\n\n</td><td>\n\nEvent monitoring software that generated the event, such as SolarWinds or SCOM. Maximum length: 100 characters.\n\n</td></tr><tr><td>\n\nOrder\n\n</td><td>\n\nNumber to define the order in which this action should be processed. Actions with lower numbers are processed first.\n\n</td></tr><tr><td>\n\nAssignment group\n\n</td><td>\n\nFor Team-based integrations, select an assignment group. If no assignment group is defined in the event field-mapping rule, then this rule is considered global.\n\nWhen the rules are running – first the global rules run and then the rules that belong to the assignment group that the event’s source instance belongs to.\n\n</td></tr><tr><td>\n\nMapping type\n\n</td><td>\n\nMapping mechanism that is used to change an event field value. -   **Map field and transform value \\(Single field\\)**:\n\nMaps the **Source field** value to the matching value in the Transform value pairs \\[em\\_mapping\\_pair\\] table and populates the **Target field**. Source and Target fields may be event fields, additional info fields, or alert tags.\n\n-   **Create or update field and set constant value \\(Constant\\)**:\n\nSets a constant value to a **Target field**. The **Target field** may be an event field, additional info field, or alert tag.\n\n-   **Map field \\(Copy field\\)**:\n\nCopies the exact value of a Source field to the specified Target field. The Source and Target fields may be Event field, Additional info field, or alert tags.\n\n-   **Map field and transform value using regex**: Generically maps the value from the Source field to the matching value in the Transform value pairs table and populate the **Target field**. Source and Target fields may be event, additional info, or alert tags fields.\n-   **Map field using regex**:\n\nCopies the value from a generically defined **Source field** to the **Target field**. The Source field must be a field from the event additional info field. The Target field may be the field of event, additional info, or alert tag. With this type, you can generically find the name of the Source field by using a regular expression \\(regex\\).\n\n-   **Map field and copy value from regex group**:\n\nCopies part of the Source field value to the Target field. Source and Target fields may be event fields, additional info fields, or alert tags. Define a regex to specify what part of the **Source field** should be copied.\n\n-   **Advanced mapping using script**:\n\nImplements your own logic for event values transformation by using a script. When the 'Run after binding' check box is selected, the rule is executed after the CI binding phase. The dedicated script also has the sys\\_id of the CI in the input parameters.\n\n**Warning:** Complex scripts may affect event processing performance.\n\n-   **Map field from reference table**\n\nUse this rule type to extract a **Source field** value from the selected **Reference table** by matching the **Field to match**value to the **Matching alert field** value and then mapping the **Source field** value to the **Target field**. The **Matching alert field** and the **Target field** may be event fields, additional info fields, or alert tags.\n\n</td></tr><tr><td>\n\nFilter\n\n</td><td>\n\nA condition for event field mapping.Select **Add Filter Condition** or **Add \"OR\" Clause** to configure multiple conditions.\n\n**Note:** The filter is case-sensitive.\n\n</td></tr><tr><td>\n\nActive\n\n</td><td>\n\nActivates or deactivates the event field mapping. If possible, find and apply another event field mapping rule.\n\n</td></tr><tr><td>\n\nRun after binding\n\n</td><td>\n\n-   When selected, the rule is executed after the CI binding phase.\n\n-   Use the relevant prefix to retrieve values from the CI record:\n\n    -   **alert\\_cmdb\\_ci.** to retrieve a field from the CI record. For example: Use 'alert\\_cmdb\\_ci.assignment\\_group’ to populate \\(and transform\\) an alert 'assignment\\_group' field with the value of the CI’s assignment group. Dot-walk to a related record is also possible. For example, use alert\\_cmdb\\_ci.asset.model\n    -   **alert\\_cmdb\\_ci\\_key.** to retrieve a value from the CMDB Tags table. For example, alert\\_cmdb\\_ci\\_key.subscription notes.\n**Warning**: Using the 'Run after binding' feature may affect event processing performance.\n\n **Note:** This check box is displayed only for the following Mapping types: **Map field and transform value \\(Single field\\)**, **Map field \\(Copy field\\)**, **Map field and transform value using regex**, **Map field and copy value from regex group**, and **Map field from reference table**.\n\n</td></tr></tbody>\n</table>    -   If you selected **Map field and transform value \\(Single field\\)**, fill in the fields as appropriate.\n\n        **Note:** Map field and transform value \\(Single field\\) is supported in **Service Operations Workspace** &gt; **Enrich Automation**.\n\n<table id=\"table_d2n_plh_wy\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nSource field\n\n</td><td>\n\nEvent field to map - includes all event and additional info fields. Note: For Additional info fields use: \"additional\\_info.&lt;field name&gt;\". When the 'Run after binding' check box is selected, you can use the **alert\\_cmdb\\_ci** and the **alert\\_cmdb\\_ci\\_key** prefixes to receive CI related data.\n\n</td></tr><tr><td>\n\nTarget field\n\n</td><td>\n\nEvent field where the mapping rule inserts or updates the value. When this field is identical to the **Source field**, the mapping rule updates the value in memory of the event field. Alert tags can also be defined by using the **&lt;t\\_&gt;** prefix.\n\n</td></tr><tr><td>\n\nRun after binding\n\n</td><td>\n\n-   When checked, activates Event field mapping after CI binding.\n-   Use the following prefix to retrieve values from the CI record:\n\n    -   **alert\\_cmdb\\_ci.** to retrieve a field from the CI record. For example, use 'alert\\_cmdb\\_ci.assignment\\_group’ to populate \\(and transform\\) an alert 'assignment\\_group' field with the value of the CI’s assignment group. Dot-walk to a related record is also possible. For example, use alert\\_cmdb\\_ci.asset.model\n    -   **alert\\_cmdb\\_ci\\_key.** to retrieve a value from the CMDB Tags table. For example, alert\\_cmdb\\_ci\\_key.subscription notes.\n**Warning**: Using the 'Run after binding' feature may affect event processing performance.\n\n</td></tr></tbody>\n</table><table id=\"table_kg4_twv_ytb\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nKey\n\n</td><td>\n\nValue that the mapping rule searches for. Whenever the event field has this value, the mapping rule adds the value listed in the **Source field** field to the field listed in the **Target field**. This field is displayed when the **Mapping type** is **Map field and transform value \\(Single field\\)**. Select **+** to add more **Key** fields, as required.\n\n</td></tr></tbody>\n</table>        **Typical use case:** To map the 'event\\_severity' field in the additional info field with possible values \\[such as WARNING, MINOR, CRITICAL, CLEAR, MAJOR\\] to the severity field, configure the following:\n\n        -   Source field: 'event\\_severity'\n        -   Target field: 'severity'\n        -   Transform value pairs:\n            -   From value: 'WARNING', to value: '4'\n            -   From value: 'MINOR', to value: '3'\n            -   and so forth...\n    -   If you selected **Create or update field and set constant value \\(Constant\\)**, fill in the fields as appropriate.\n\n<table id=\"table_r4p_cmh_wy\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nTarget field\n\n</td><td>\n\nThe **Target field** may be an an event field, additional info field, or alert tag.\n\n Typical use case: Set alert severity to 1 for all events that match the filter.\n\n</td></tr><tr><td>\n\nValue\n\n</td><td>\n\nValue you want to use for the **To field**. This field is displayed when the **Mapping type** is **Constant**.\n\n</td></tr></tbody>\n</table>        **Typical use case:** Set alert severity to 1 for all events that match the filter.\n\n    -   If you selected **Map field \\(Copy field\\)**, fill in the fields as appropriate.\n\n<table id=\"table_uff_rws_qvb\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nSource field\n\n</td><td>\n\n**Source field** value to be copied to the **Target field** field. The **Source field** may be an event field, additional info field, or alert tag.\n\n</td></tr><tr><td>\n\nTarget field\n\n</td><td>\n\nEvent field where the mapping rule inserts or updates the value.The **Target field** may be an event field, additional info field, or alert tag.\n\n</td></tr><tr><td>\n\nRun after binding\n\n</td><td>\n\n-   When checked, activates Event field mapping after CI binding.\n-   Use the relevant prefix to retrieve values from the CI record:\n\n    -   **alert\\_cmdb\\_ci.** to retrieve a field from the CI record. For example, use 'alert\\_cmdb\\_ci.assignment\\_group’ to populate \\(and transform\\) an alert 'assignment\\_group' field with the value of the CI’s assignment group. Dot-walk to a related record is also possible. For example, use alert\\_cmdb\\_ci.asset.model\n    -   **alert\\_cmdb\\_ci\\_key.** to retrieve a value from the CMDB Tags table. For example, alert\\_cmdb\\_ci\\_key.subscription notes.\n**Warning**: Using the 'Run after binding' feature may affect event processing performance.\n\n</td></tr></tbody>\n</table>        **Typical use case:** To copy the IP field from the event additional info field to the alert field node, use the following:\n\n        -   'Source field': ip\n        -   'Target field': node\n    -   If you selected **Map field and transform value using regex**, fill in the fields as appropriate.\n\n<table id=\"table_lnn_pws_qvb\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nSource field\n\n</td><td>\n\nSource field value to be copied to the **Target field** field. The **Source field** may be an event field, additional info field, or alert tag.\n\n</td></tr><tr><td>\n\nTarget field\n\n</td><td>\n\nEvent field where the mapping rule inserts or updates the value.The **Target field** may be an event field, additional info field, or alert tag.\n\n</td></tr><tr><td>\n\nRun after binding\n\n</td><td>\n\n-   When checked, activates Event field mapping after CI binding.\n-   Use the relevant prefix to retrieve values from the CI record:\n\n    -   **alert\\_cmdb\\_ci.** to retrieve a field from the CI record. For example, use 'alert\\_cmdb\\_ci.assignment\\_group’ to populate \\(and transform\\) an alert 'assignment\\_group' field with the value of the CI’s assignment group. Dot-walk to a related record is also possible. For example, use alert\\_cmdb\\_ci.asset.model\n    -   **alert\\_cmdb\\_ci\\_key.** to retrieve a value from the CMDB Tags table. For example, alert\\_cmdb\\_ci\\_key.subscription notes.\n**Warning**: Using the 'Run after binding' feature may affect event processing performance.\n\n</td></tr></tbody>\n</table>        **Typical use case:** To map severity from the field color in the Additional info field to the Severity field, use:\n\n        -   Source field: 'color'\n        -   Target field: 'severity'\n        -   Transform value pairs:\n            -   From value: '.\\*red', To value: '1'. This covers both 'dark red', 'light red', and other values containing 'red' and maps them all to '1'.\n            -   and so forth...\n<table id=\"table_a2p_fxs_qvb\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nKey\n\n</td><td>\n\nValue that the mapping rule searches for. Whenever the event field has this value, the mapping rule adds the value listed in the **Source field** field to the field listed in the **Target field**. This field is displayed when the **Mapping type** is **Map field and transform value \\(Single field\\)**. Select **+** to add more **Key** fields, as required.\n\n</td></tr></tbody>\n</table>    -   If you selected **Map field using regex**, fill in the fields as appropriate.\n\n<table id=\"table_nht_pws_qvb\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nSource field\n\n</td><td>\n\nGenerically defined Source field value to be copied to the **Target field** field. The **Source field** must be a field from the event additional info field. With this type, you can generically find the name of the Source field by using a regular expression \\(regex\\).\n\n</td></tr><tr><td>\n\nTarget field\n\n</td><td>\n\nEvent field where the mapping rule inserts or updates the value.The **Target field** may be an event field, additional info field, or alert tag.\n\n</td></tr></tbody>\n</table>        **Typical use case:** To map the 'region' field from the additional\\_info field that appears as 'tags.region' or 'tags\\|region' or 'cloud.region' to an alert tag **t\\_region**, use:\n\n        -   'Source field': \\*region\n        -   'Target field': t\\_region\n    -   If you selected **Map field and copy value from regex group**, fill in the fields, as appropriate.\n\n<table id=\"table_tm5_pws_qvb\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nSource field\n\n</td><td>\n\nGenerically defined Source field value to be copied to the **Target field** field. The Source field must be a field from the event additional info field. With this type, you can generically find the name of the Source field by using a regular expression \\(regex\\).\n\n</td></tr><tr><td>\n\nTarget field\n\n</td><td>\n\nEvent field where the mapping rule inserts or updates the value.The **Target field** may be an event field, additional info field, or alert tag.\n\n</td></tr><tr><td>\n\nRun after binding\n\n</td><td>\n\n-   When checked, activates Event field mapping after CI binding.\n-   Use the relevant prefix to retrieve values from the CI record:\n\n    -   **alert\\_cmdb\\_ci.** to retrieve a field from the CI record. For example, use 'alert\\_cmdb\\_ci.assignment\\_group’ to populate \\(and transform\\) an alert 'assignment\\_group' field with the value of the CI’s assignment group. Dot-walk to a related record is also possible. For example, use alert\\_cmdb\\_ci.asset.model\n    -   **alert\\_cmdb\\_ci\\_key.** to retrieve a value from the CMDB Tags table. For example, alert\\_cmdb\\_ci\\_key.subscription notes.\n**Warning**: Using the 'Run after binding' feature may affect event processing performance.\n\n</td></tr><tr><td>\n\nRegex group expression\n\n</td><td>\n\n.\\*\\_.\\*\\_\\(.\\*\\)\\_.\\*\n\n</td></tr></tbody>\n</table>        **Typical use case:** To extract the third octet from the IP and save it in the additional info **third\\_octet** field, use:\n\n        -   'Source field': ip\n        -   'Target field': third\\_octet\n        -   'Regex group expression': .\\*\\_.\\*\\_\\(.\\*\\)\\_.\\*\n    -   If you selected **Advanced mapping using script**, fill in the fields as appropriate.\n\n<table id=\"table_vtv_pws_qvb\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nScript\n\n</td><td>\n\nThe code editor gives text editor support for inline scripts. The code editor has these features for the supported language services and Inline scripts: Syntax coloring, indentation, line numbers, and automatic creation of closing braces and quotes, Auto-suggestions, and auto-completions.Editing tips:\n\n-   To insert a fixed space anywhere in your code, press the Tab key.\n-   To indent a single line of code, select in the leading white space of the line and then press Tab.\n-   To indent one or more lines of code, select the code and then press Tab.\n-   To decrease the indentation, press Shift+Tab.\n-   To remove one tab from the start of a line of code, select in the line and press Shift+Tab.\n-   To declare variables, use the var keyword so that they remain within the proper JavaScript scope.\n\n\n</td></tr><tr><td>\n\nRun after binding\n\n</td><td>\n\nWhen the 'Run after binding' check box is selected, the rule is executed after the CI binding phase. The dedicated script also has the sys\\_id of the CI in the input parameters.\n\n **Warning:** Complex scripts may affect event processing performance.\n\n</td></tr></tbody>\n</table>    -   If you selected **Map field from reference table**, fill in the fields as appropriate.\n\n<table id=\"table_jrn_r3g_4xb\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nReference table\n\n</td><td>\n\nThe reference table. Select the table from where the field is to be mapped to the Target field in the event.\n\n</td></tr><tr><td>\n\nField to match\n\n</td><td>\n\nThe field from the Reference table to be matched with the Matching alert field from the event. It’s used to filter out the Reference table records.\n\n</td></tr><tr><td>\n\nSource field\n\n</td><td>\n\n**Source field** value to be copied to the **Target field** field. The **Source field** is the field of the table that was selected as the Reference table.\n\n</td></tr><tr><td>\n\nMatching alert field\n\n</td><td>\n\nEvent field to find matching Reference table records. The **Matching alert field** is matched with the **Field to match** field.\n\nThe Matching alert field may be the Event field, Additional info field, or the Alert tag.\n\n</td></tr><tr><td>\n\nTarget field\n\n</td><td>\n\nEvent field where the mapping rule inserts or updates the value.The **Target field** may be an event field, additional info field, or alert tag.\n\n</td></tr><tr><td>\n\nRun after binding\n\n</td><td>\n\n-   When checked, activates Event field mapping after CI binding.\n-   Use the relevant prefix to retrieve values from the CI record:\n\n    -   **alert\\_cmdb\\_ci.** In the **Matching alert field**, to retrieve a value of a field from a CI record. For example: 'alert\\_cmdb\\_ci.ip\\_address’ retrieves IP address information of bound CIs. When the **Matching alert field** and the **Field to match** fields are reference fields, dot-walking to sys\\_id in the **Matching alert field** is required. For example, to use the 'assignment\\_group' value of bound CIs to match with the **Field to match** field, use the following expression in the **Matching alert field**: alert\\_cmdb\\_ci.assignment\\_group.sys\\_id\n    -   **alert\\_cmdb\\_ci\\_key.** to retrieve a value from the CMDB Tags table. For example, alert\\_cmdb\\_ci\\_key.subscription notes.\n**Warning**: Using the 'Run after binding' feature may affect event processing performance.\n\n</td></tr></tbody>\n</table>        **Typical use case:** Extract 'short\\_description' from the 'pc\\_vendor\\_cat\\_item' records matching its 'name' field with the 'cat\\_item\\_name' field in the Additional info field of the event and map it to the 'description' field on the event in the following fields:\n\n        -   'Reference table': pc\\_vendor\\_cat\\_item\n        -   'Field to match': name\n        -   'Source field': short\\_description\n        -   'Matching alert field': cat\\_item\\_name\n        -   'Target field': description\n3.  Right-click the form header and select **Save**.\n\n4.  Select **Submit**.\n\n\n## Example\n\nThe following values comprise a predefined rule that is applied to events in the Trap From Enterprise 9 class. If the events contain the `snmpTrapOID` element with a value of `iso.org.dod.internet.private.enterprises.cisco.0.0`, the mapping rule changes the value to `reload` in the alerts. If the events contain the `snmpTrapOID` element, a value of `iso.org.dod.internet.private.enterprises.cisco.0.1`, the mapping rule changes the value to `tcpConnectionClose` in the alerts.\n\n<table id=\"simpletable_lvs_5hf_jt\"><thead><tr><th>\n\nField\n\n</th><th>\n\nValues\n\n</th></tr></thead><tbody><tr><td>\n\nName\n\n</td><td>\n\ncisco.snmpTrapOID\n\n</td></tr><tr><td>\n\nSource\n\n</td><td>\n\nTrap From Enterprise 9\n\n</td></tr><tr><td>\n\nMapping type\n\n</td><td>\n\nMap field and transform value \\(Single field\\).\n\n</td></tr><tr><td>\n\nSource field\n\n</td><td>\n\nsnmpTrapOID\n\n</td></tr><tr><td>\n\nTarget field\n\n</td><td>\n\nsnmpTrapOID\n\n</td></tr><tr><td>\n\nTransform Value Pairs\n\n</td><td>\n\n-   Pair 1\n    -   **Key**: iso.org.dod.internet.private.enterprises.cisco.0.0\n    -   **Value**: reload\n-   Pair 2\n    -   **Key**: iso.org.dod.internet.private.enterprises.cisco.0.1\n    -   **Value**: tcpConnectionClose\n\n</td></tr></tbody>\n</table>## What to do next\n\nTest an event field mapping by sending an event that includes a field that is present in the event field mapping.\n\n**Parent Topic:**[Event field mapping configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/c_EMEventFieldMapping.md)\n\n"}}