I wish the link in a Resolved incident email expired as soon as the record was closed. Someone reopened a 2 week old INC. #servicenow (link)

Better yet, what if it opened a new Incident record with the same information but a new SLA? #servicenow (link)

The culprit here is an Inbound Email Action named Update Incident (BP) (sys_id = 498e10410a0a0b4b007c8c7f63531747).

It reads:

gs.include('validators');if (current.getTableName() == "incident") { current.comments = "reply from: " + email.origemail + "\n\n" + email.body_text; if (email.subject.toLowerCase().indexOf("please reopen") >= 0) { current.state = "2"; current.work_notes = "The caller did not feel that this issue was resolved"; } if (email.body.assign != undefined) current.assigned_to = email.body.assign; if (email.body.priority != undefined && isNumeric(email.body.priority)) current.priority = email.body.priority; if (email.body.category != undefined) current.category = email.body.category; if (email.body.short_description != undefined) current.short_description = email.body.short_description; current.update();}

So if the subject line contains the words please reopen we set the state of the Incident to 2, and update the Work Notes.

Maybe a better, non-zombified solution would to create a new Incident if the record is in closed state. We can do some nice association, and update the Work Notes on the original.

gs.include('validators');if (current.getTableName() == "incident") { current.comments = "reply from: " + email.origemail + "\n\n" + email.body_text; if (email.subject.toLowerCase().indexOf("please reopen") >= 0) { if (current.state == "7") { // If the current record is in closed state create a new Incident and relate it to this one. // Copies the default incident form fields, you may wish to customise. var new_inc = new GlideRecord("incident"); new_inc.caller_id = current.caller_id; new_inc.location = current.location; new_inc.category = current.category; new_inc.cmdb_ci = current.cmdb_ci; new_inc.impact = current.impact; new_inc.urgency = current.urgency; new_inc.priority = current.priority; new_inc.short_description = "Reopened from " + current.number + ": " + current.short_description; new_inc.contact_type = current.contact_type; new_inc.assignment_group = current.assignment_group; new_inc.work_notes = "The caller did not feel that this issue was resolved\n\nReopened from " + current.number + "\n\nPlease refer to previous worknotes"); new_inc.parent = current.sys_id; new_inc.insert(); current.work_notes = "Re-opened by customer. New incident number is " + new_inc.number; } else { current.state = "2"; current.work_notes = "The caller did not feel that this issue was resolved"; } } if (email.body.assign != undefined) current.assigned_to = email.body.assign; if (email.body.priority != undefined && isNumeric(email.body.priority)) current.priority = email.body.priority; if (email.body.category != undefined) current.category = email.body.category; if (email.body.short_description != undefined) current.short_description = email.body.short_description; current.update();}

This creates a new Incident with all the same attributes as the dead (closed) one, based on the right caller and it's associated back to the closed incident in the description, and using the parent field.

How's THAT for a slice of fried gold?