Overview
ServiceNow is an IT service management platform for recording, tracking, and managing a company’s enterprise-level IT processes in a single location.
The Datadog ServiceNow integration is a two-way integration that allows you to:
- Push Datadog-generated events to ServiceNow tickets, as well as manage the resolution workflow from within Datadog through IT service management (ITSM) and IT operations management (ITOM)
- Use Datadog as a discovery mechanism for ServiceNow Configuration Management Database (CMDB) Configuration Items (CIs) with the service graph connector
- Enrich business-specific information stored as CIs in ServiceNow CMDB with your hosts and services information from Datadog, enabling you to better understand your infrastructure usage, accelerate troubleshooting, and maximize resource utilization
Datadog integrates with the following ServiceNow tools:
Note: The Datadog ServiceNow integration supports ServiceNow releases that are not listed as end of life.
CMDB setup
Service Graph Connector for Datadog
Service Graph Connector for Datadog can automatically populate server and database configuration items (CIs) in the CMDB for new resources discovered by Datadog. The Service Graph connector is available through the ServiceNow store.
For configuration, follow the Service Graph Connector’s guided setup instructions.
Supported CI Types:
The notes below only apply if you have already configured the integration for ServiceNow ITOM/ITSM:
- Service Graph Connector does not use the
Target table
and Custom table
values from the configuration tile. You can save the integration with the Target table default values. - The same ITOM/ITSM user can be used for Service Graph Connector by granting this user the role of cmdb_import_api_admin as described in the Service Graph Connector’s guided setup instructions.
Host tagging
Enrich your Datadog hosts with ServiceNow CMDB metadata through host tagging.
To enable ingestion of host tags:
- Configure a Query Builder query in your ServiceNow instance that returns all of the hosts you wish to tag in Datadog.
- Schedule the query to execute at your desired refresh interval.
- Once the query has been saved in ServiceNow, go to Datadog’s ServiceNow integration tile. Select the Host Tagging tab
- Under Query Configuration, click the Add New Row button.
- Select the ServiceNow Instance and the Query from the dropdown menus.
- Select a value for the Hostname Column that maps your query’s root CI hostname field to Datadog’s hostname field.
- Select any optional field name remapping with Column Name Maps.
- Click Save.
Expect host tags to populate in Datadog shortly after your queries’ scheduled executions.
Monitor the ingestion process in the Datadog Events Explorer by scoping your search query on source:servicenow
.
Troubleshooting
For host tagging to work correctly, ensure that the following are true in your system:
- The user who created and executes the Query Builder query matches a username in your Datadog configuration. The user in ServiceNow must have the role
cmdb_query_builder_read
. - The number of results returned by your query must be less than or equal to the
glide.cmdb.query.max_results_limit
setting in ServiceNow. By default, the maximum number of results is 10000. To change the setting, go to Configuration -> CMDB Properties -> Query Builder Properties. - All CIs configured in your Query Builder query must have a 1 label. This ensures you have not created any duplicate CIs, which the parser does not support.
Limitations
- Ingestion is limited to 100k hosts per execution.
- Updates to hosts are throttled to a few thousand per hour. Take this limit into consideration when choosing your schedule interval.
- Tagging does not work for Linux machines with lower case host names, because host aliases in Datadog are case sensitive.
Service ingestion
Enrich your Datadog Service Catalog with ServiceNow CMDB metadata through service ingestion.
With service ingestion, you can populate your Datadog Service Catalog with services from your ServiceNow CMDB.
Setup
To enable ingestion of service data:
- Configure a Query Builder query in your ServiceNow instance that returns all of the services with which you wish to enrich the Service Catalog.
- Schedule the query to execute at your desired refresh interval.
- Once the query is saved in ServiceNow, go to Datadog’s ServiceNow integration tile. Select the Service Ingestion tab.
- Under Query Configuration, click the Add New Row button.
- Select the ServiceNow Instance and the Query from the dropdown menus.
- Select a value from the Service Name Column dropdown menu. The value matches the column name on your query’s root service CI, and populates the service name in the service catalog.
- Configure schema mappings to pull additional metadata about your service into the service catalog. See Service definitions for details. For Datadog to accept the ingestion, each field in the mapping needs to be of the correct type to map to the service catalog service definition schema.
- Click Save.
Expect to see service data populated in Datadog a few minutes after your queries’ scheduled executions. To view ingestion errors, go to the Events Explorer and search for events with source:servicenow
.
Troubleshooting
For service ingestion to work correctly, ensure that the following are true in your system:
- The user who created and executes the Query Builder query matches a username in your Datadog configuration. The user in ServiceNow must have the role
cmdb_query_builder_read
. - The number of results returned by your query must be less than or equal to the
glide.cmdb.query.max_results_limit
setting in ServiceNow. By default, the maximum number of results is 10000. To change the setting, go to Configuration -> CMDB Properties -> Query Builder Properties. - All CIs configured in your Query Builder query must have a 1 label. This ensures you have not created any duplicate CIs, which the parser does not support.
ITOM and ITSM setup
To use any of the modules, first, install the latest Datadog Update Set on your ServiceNow instance, and configure the ServiceNow integration tile in Datadog.
- Install the latest Datadog Update Set
- Set Datadog account permissions
- Instructions for use with ITOM and ITSM
Install the Datadog update set
In ServiceNow:
- Search for Update Set and find Retrieved Update Sets in the left menu.
- Manually import the
Datadog-SNow_Update_Set_vX.X.X.xml
file provided. - Once you upload the XML file, the Update Set shows a state of
Loaded
. Click on the name of the Update Set to preview and commit the code to the system. - Preview the Update Set to ensure there are no errors. Then select Commit Update Set to merge the application into your system.
After setup is complete, search for Datadog in the navigation menu and see tables appear.
Permissions
In order to access import tables and apply transform maps, the ServiceNow user needs the following permissions:
x_datad_datadog.user
import_set_loader
import_transformer
If you’d like to send notifications directly to the Incident table or Event table, you need the ITIL
and evt_mgmt_integration
roles.
Configuring Datadog for use with ITOM and ITSM modules
Notifications using @servicenow-<INSTANCE_NAME>
in Datadog populate the interim tables selected in your ServiceNow tile. Note the following steps assume you have already set up the ServiceNow tile in the Datadog integrations page. Once that has been completed:
- From the dropdown, select the intermediary table you want to send notifications to from the dropdown.
- To validate the integration is set up correctly, add
@servicenow-<INSTANCE_NAME>
in a monitor or event notification. The raw data populates rows in the interim table and is forwarded to the ServiceNow table specified in the mappings and transformations you created. - Use transform maps to customize the formatting for data sent to the tables,
- Configure the ServiceNow integration tile in Datadog
- Navigate in Datadog to the ServiceNow integration tile, on the Integrations page.
- Click on
Add New Instance
. - Add the instance name, which is the subdomain of your ServiceNow domain:
<INSTANCE_NAME>.service-now.com
. - Add the username and password for your ServiceNow instance.
Note: You can create a limited user in ServiceNow just for Datadog.
The Datadog Incident and Datadog Event tables use a transform map to transform Datadog events to corresponding incidents and events in ServiceNow.
Troubleshooting
If you’re not seeing events in your ServiceNow tables and instead have
An error message in your Datadog integration tile or an Error while trying to post to your ServiceNow instance
notification:
- Verify only the subdomain was used when entering your instance name.
- Verify the user you created has the required permissions.
- Verify the username and password are correct.
The integration is configured, an alert triggered, and no ticket is created:
- Confirm that the interim table is populated. If so, the issue is with mappings and transformations. You can debug your mappings and scripts further by navigating to Transform Errors in ServiceNow.
- Confirm that you’re working with the interim table you specified in the tile.
The ServiceNow user needs rest_service
and x_datad_datadog.user
roles so that it can access the import tables. If you’re using the legacy way of sending notifications directly to either the Incident table or Event table, you need the permissions itil
and evt_mgmt_integration
.
Need additional help? Contact Datadog support.
Knowledge base
Datadog import host auto-flush rule
To prevent the import set table x_datad_datadog_import_host
from accumulating too many rows, an auto-flush rule has been added to the Table Cleaner tool to keep only the last 24 hours of data. This configuration setting can be changed as needed by navigating to sys_auto_flush_list.do
in the filter navigator and going into the rule for the x_datad_datadog_import_host
table. The Age in seconds
field can be updated accordingly.
Auto-generate support tickets from Datadog alerts
After ServiceNow is connected to your Datadog account, alerts received can automatically create support tickets and send them to the ServiceNow ticketing queue. From there, your support team is notified of issues using the communication workflows that you have already established inside ServiceNow. Mention @servicenow
in the alert message or add @servicenow
to the notification list for that monitor.
Use variables in ticket payload and field mappings
Variables can be used in the body of your alerts or in field mappings to ensure details from the event are included in ServiceNow. For example, you can include the title and severity in the appropriate ServiceNow field or you can include a link back to the specific incident in Datadog right from the ServiceNow ticket.
Incident Priority field mapping
The priority
field in ServiceNow incidents is read only and can only be updated using priority lookup rules.
Define Impact
and Urgency
in monitors to calculate the ServiceNow incident priority.
Automate support resolution workflow
Once the monitor state returns to normal, the associated support ticket is automatically marked as “resolved”.
Defining custom mappings
Click one of the tables, for example Datadog Incident Tables, and scroll to the bottom of the record to see the link for the associated transform map.
Understanding the mapping
Click on the name of the transform map to view the record:
At the top are two important fields on the Transform record - Source table
and Target table
:
Notes:
- The source is the import set table you selected (Datadog Incident Tables) and the target is your actual incident table (or event table) where events are stored.
- The field mappings are at the bottom of the record. Some basic mappings are included. This is where you select the fields to include, define the format, and select the target fields in your ServiceNow instance.
Add a new field mapping
Click New:
Select the source and target fields for one to one mappings:
Or, check the Use source script box and define transformations:
Note: For mapping any custom fields in the Integration Tile, you can use the following mapping script for either the Datadog Event and Incident Transform maps. In this example the field my_field
was defined as a custom field in the integration tile:
answer = (function transformEntry(source)
{
var additional_info = JSON.parse(source.additional_info);
return additional_info.custom_my_field;
})(source);
Define multiple mappings
Use Mapping Assist (under Related Links) to map several source and target fields:
Validation
To validate the integration is set up correctly, add @servicenow
in a monitor or event notification. The raw data populates rows in the interim table and is forwarded to the ServiceNow table specified in the mappings and transformations you created.
Further Reading
Additional helpful documentation, links, and articles: