{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":30569,"path":"it-operations-management/event-management/send-events-via-web-service.md","title":"Pushing events to the instance using web service API","bundle":null,"doc_type":null,"release":"australia","body":"\n# Pushing events to the instance using web service API\n\nYou can use a web service interface, supported by ServiceNow, that operates on the JSON object as the data input and output format.\n\n## Before you begin\n\nRole required: evt\\_mgmt\\_integration\n\n## About this task\n\nTo insert records in the event \\[em\\_event\\] table with a single call, use this web service API:\n\n`https://.service-now.com/api/global/em/jsonv2`\n\n**Note:** Business rules on the event table are not invoked when this URL is used.\n\nDo not add additional fields to an event by adding a custom field to the event table \\[em\\_event\\]. However, additional fields should be included in the **Additional information** \\[additional\\_info\\] field of the event. For more information about how to include additional fields in events, see [Custom alert fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/populate-custom-alert-fields.md).\n\nFor information about troubleshooting performance issues with inbound integrations, see [Troubleshooting inbound integrations performance](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0746875).\n\nThe URL in the format: `http://.service-now.com/em_event.do?JSONv2&sysparm_action=insertMultiple` is also supported in case you do want to activate Business rules. However, the performance of the first URL is superior.\n\nTo work with the URL that ends with `=insertMultiple`, add the following properties, with their respective values, to the MID Server:\n\n- \"mid.probe.event.queue.compress\" - value: false\n- \"mid.probe.event.bulk\\_size\" - value: 100\n- \"mid.probe.event.endpoint.url\" - value: em\\_event.do?JSONv2%26sysparm\\_action=insertMultiple\n\n## Procedure\n\n1. Send the request with these headers:\n\n\n
\n\nParameter\n\n\n\nType\n\n\n\nDescription\n\n
\n\nAccept\n\n\n\nString\n\n\n\nThe acceptable type for this message.The default value is `application/json`.\n\n
\n\nContent-Type\n\n\n\nString\n\n\n\nThe content type for this message.The default value is `application/json`.\n\n
\n\nPOST\n\n\n\nString\n\n\n\nThe request type is POST, with one or more trailing records.\n\n
2. One or more events in JSON format can be sent as the payload of the web service call.\n\n Event fields that should be populated are:\n\n\n
\n\nVariable\n\n\n\nDescription\n\n
\n\nsource\n\n\n\nThe name of the event source type. For example, SCOM or SolarWinds.\n\n
\n\nevent\\_class\n\n\n\nSpecific instance of the **source**. For example, `SCOM 2012 on 10.20.30.40`\n\n
\n\nnode\n\n\n\nThe **node** field should contain an identifier for the Host \\(Server/Switch/Router/etc.\\) that the event was triggered for. The value of the **node** field can be one of the following identifiers of the Host: - Name\n- FQDN\n- IP\n- Mac Address\nIf it exists in the CMDB, this value is also used to bind the event to the corresponding ServiceNow CI.\n\n
\n\nresource\n\n\n\nPopulate this field with the device or application name. Use this field if the event refers to a device \\(such as Disk, CPU, or Network Adapter\\) or to an application or service running on a Host. Examples: `Disk C:\\`, `Nic 001`, or `Trade web application`.\n\n
\n\nmetric\\_name\n\n\n\nName of the metric that triggered the alert. For example, `Used Memory` or `Total CPU utilization`.\n\n
\n\ntype\n\n\n\nThe type of event. This type might be similar to the **metric\\_name** field, but is used for general grouping of event types.\n\n
\n\nmessage\\_key\n\n\n\nThis value is used for de-duplication of events. For example, there might be two events for the same CI, where one event has CPU of 50% and the next event has CPU of 99%. Where both events must be mapped to the same ServiceNow alert, they should have the same message key. The field can be left empty, in which case the field value defaults to `source+node+type+resource+metric_name`. The **message\\_key** should be populated only when there is a better identifier than the default.\n\n
\n\nseverity\n\n\n\nSeverity of the event. ServiceNow values for severity range from 1 – Critical to 5 – OK, with the severity of 0 – Clear. Original severity values should be sent as part of the additional information.\n\n
\n\nadditional\\_info\n\n\n\nThis field contains a JSON string \\(stringified JSON\\) with key/value pairs representing supplemental information not mapped to standard event fields. Examples include IDs of objects in the event source, event priority \\(if different from severity\\), and assignment group information. Values not already in JSON key/value format are normalized to stringified JSON when the event is processed.\n\n
\n\ntime\\_of\\_event\n\n\n\nTime when the event occurred on the event origin. The format is: yyyy-MM-dd HH:mm:ssThe specified time must be according to GMT.\n\n
\n\nresolution\\_state\n\n\n\nOptional – Indicates whether an event has been resolved or is no longer occurring. Some event monitors use ‘clear’ severity to indicate resolution. Other event monitors use a ‘close’ value for severity. This field is used for those monitors proffering the latter. Valid values are `New` and `Closing`.\n\n
3. To create multiple records with a single call, trigger the event web service using the following URL:\n\n Replace the <instance name> variable with the name of the required instance.\n\n `https://.service-now.com/api/global/em/jsonv2`\n\n Example showing the payload for two events that are sent in a single web service call:\n\n ```\n {\n \"records\": [\n {\n \"source\": \"SCOM\",\n \"event_class\": \"SCOM 2012 on scom.server.com\",\n \"resource\": \"D:\",\n \"node\": \"name.of.node.com\",\n \"metric_name\": \"Percentage Logical Disk Free Space\",\n \"type\": \"Disk space\",\n \"severity\": \"4\",\n \"description\": \"The disk D: on computer V-W2K8-abc.abc.com is running out of disk space. The value that exceeded the threshold is 38% free space.\",\n \"additional_info\": \"{\\\"scom-severity\\\": \\\"Medium\\\", \\\"metric-value\\\": \\\"38\\\", \\\"os_type\\\": \\\"Windows.Server.2008\\\"}\"\n }\n },\n {\n \"source\": \"SCOM\",\n \"event_class\": \"SCOM 2012 on scom.server.com\",\n \"resource\": \"MSSQL-database-name\",\n \"node\": \"other.node.com\",\n \"metric_name\": \"DB Allocated Size (MB)\",\n \"type\": \"Database Storage\",\n \"severity\": \"3\",\n \"description\": \"High number of active connections for MSSQL-database-name running on name.of.node.com. Active connections exceed 5000.\",\n \"additional_info\": \"{\\\"scom-severity\\\": \\\"Medium\\\", \\\"metric-value\\\": \\\"38\\\", \\\"os_type\\\": \\\"Windows.Server.2008\\\"}\"\n }\n }\n ]\n }\n ```\n\n4. Trigger the event web service using the following URL.\n\n Replace <instancename> with the name of the required instance: `https://.service-now.com/api/global/em/jsonv2`\n\n Example showing the payload for one event that is sent in a single web service call:\n\n ```\n {\n \"records\": [\n {\n \"source\": \"SCOM\",\n \"event_class\": \"SCOM 2007 on scom.server.com\",\n \"resource\": \"C:\",\n \"node\": \"name.of.node.com\",\n \"metric_name\": \"Percentage Logical Disk Free Space\",\n \"type\": \"Disk space\",\n \"severity\": \"4\",\n \"description\": \"The disk C: on computer V-W2K8-dfg.dfg.com is running out of disk space. The value that exceeded the threshold is 41% free space.\",\n \"additional_info\": \"{\\\"scom-severity\\\": \\\"Medium\\\", \\\"metric-value\\\": \\\"38\\\", \\\"os_type\\\": \\\"Windows.Server.2008\\\"}\"\n }\n }\n ]\n }\n ```\n\n Example: cURL request:\n\n ```\n {\n curl -X POST \"https://.service-now.com/api/global/em/jsonv2\" \\\n --header \"Content-Type: application/json\" \\\n --user \"username:password\" \\\n --data '{\n \"records\": [\n {\n \"source\": \"SCOM\",\n \"event_class\": \"SCOM 2007 on scom.server.com\",\n \"resource\": \"C:\",\n \"node\": \"name.of.node.com\",\n \"metric_name\": \"Percentage Logical Disk Free Space\",\n \"type\": \"Disk space\",\n \"severity\": \"4\",\n \"description\": \"The disk C: on computer V-W2K8-dfg.dfg.com is running out of disk space. The value that exceeded the threshold is 41% free space.\",\n \"additional_info\": \"{\\\"scom-severity\\\": \\\"Medium\\\", \\\"metric-value\\\": \\\"38\\\", \\\"os_type\\\": \\\"Windows.Server.2008\\\"}\"\n }\n }\n ]\n }'\n \n ```\n\n\n**Related topics** \n\n\n[Pushing events to the MID Server using web service API](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/event-collection-via-MID-using-push.md)\n\n"}}