On a schedule
Spot recurring incidents in ServiceNow every morning
Each morning your IT channel gets a short list of problems that keep coming back across the last week of incidents, with counts and links.
- Runs
- On a schedule
- Apps
- ServiceNow, Slack
- AI
- Yes, uses the built-in AI allowance
- Access
- ServiceNow read; Slack chat:write
Send this to your assistant
Create a ClickRuntime automation: every morning, look at the last 7 days of ServiceNow incidents, have AI group similar ones into recurring issues, and post them to #it-ops with counts and example incident numbers.
First time? Adding ClickRuntime to your assistant takes about two minutes.
Why use it
Why teams use this automation
A university IT department closes hundreds of incidents a week. Each one is handled on its own: a printer reset here, a password unlock there. Nobody has time to step back and notice that forty of last week's tickets were the same Wi-Fi problem in one building, which a single root cause fix would have prevented.
This automation steps back for them. Every morning it pulls the last seven days of incidents, AI groups the ones that describe the same underlying issue, and a short summary is posted in #it-ops with the count and example incident numbers for each recurring problem. The team can decide what deserves a problem record.
What you get out of it
Fix causes, not symptoms
Seeing that the same issue happened forty times makes the case for a permanent fix. Solving the root cause removes a whole stream of tickets.
Patterns humans miss
Similar incidents are often logged with different wording by different people. Grouping by meaning catches them even when the descriptions do not match.
Evidence for problem management
Each group comes with counts and incident numbers. That is exactly what you need to open a problem record or justify a change.
A short read each morning
The summary is a handful of lines in Slack. It fits into the morning stand-up without anyone running a report.
How it works
What happens, step by step
Every morning, ClickRuntime pulls the incidents created in ServiceNow over the last seven days.
It keeps just the number, category and short description of each.
AI groups incidents that describe the same underlying issue and counts each group.
The recurring issues are posted to #it-ops with their counts and example incident numbers.
Before it runs live
- Connect ServiceNow
- Connect Slack, then invite the app to the channel (type /invite @ClickRuntime there)
What you get
Build your own
Need it to work differently?
Your own rules
Conditions, thresholds, filters and exceptions, written the way you'd explain them to a colleague.
Any number of apps
One automation can read from one app and update several others. Over 248 apps are ready, and anything with an API works too.
AI where it helps
Summaries, classification, extraction and drafts use ClickRuntime's built-in AI, with no extra key.
On a schedule or on each event
Runs as often as every 5 minutes, or the moment an app sends an event, and keeps track of what it already handled.
Changes you can ask for
- Run it at a different time, more or less often, or only on weekdays
- Change what the AI looks for, or how it writes the result
- Add another app, for example also send it to Google Sheets
- Combine it with other ServiceNow and Slack steps into one automation
Under the hood
The code that runs this automation
from clickruntime import on_trigger, credentials, http, ai, notify
INSTANCE = "northwind.service-now.com"
def sn(method, path, **kw):
r = http.request(method, f"https://{INSTANCE}/api/now/table/{path}", auth=(credentials.secret("SERVICENOW_USER"), credentials.secret("SERVICENOW_PASSWORD")),
headers={"Accept": "application/json"}, **kw)
r.raise_for_status()
return r.json()["result"]
@on_trigger
def run(event):
incidents = sn("GET", "incident", params={"sysparm_query": "sys_created_on>=javascript:gs.daysAgoStart(7)", "sysparm_limit": "400",
"sysparm_fields": "number,category,short_description"})
if not incidents:
return {"incidents": 0}
lines = "\n".join(f"{i['number']} [{i['category']}] {i['short_description'][:120]}" for i in incidents)
summary = ai.generate(f"Incidents from the last 7 days:\n{lines}\n\nGroup incidents describing the same underlying issue. "
"List groups with 3 or more incidents as: issue - count - up to 3 example numbers. Most frequent first.",
max_output_tokens=600).text.strip()
notify.slack(f"🔁 Recurring issues, last 7 days ({len(incidents)} incidents):\n{summary}", channel="#it-ops")
return {"incidents": len(incidents)}FAQ
Common questions
How many incidents does it look at?
Can I look back further?
Does it create problem records?
What permissions does it need?
Does it need AI?
How many runs does it use?
Can I change how it works?
Related
You might also like
Escalate ServiceNow incidents before they breach SLA
Open incidents that have used more than 75 percent of their SLA are raised in priority and flagged in Slack once, while there is still time to act.
See how it worksPost new high-priority ServiceNow incidents to Slack
Every new priority 1 or 2 incident appears in your IT Slack channel within minutes, with its number, short description and a link.
See how it worksGet a daily news digest in Slack
Each morning your team gets a short summary of what's new on the sites and blogs you follow.
See how it worksKeep exploring
Set up “Spot recurring incidents in ServiceNow every morning” from your assistant
Copy the prompt above, or connect your assistant first. Free plan, no credit card.
