Use event input information

  • Release version: Australia
  • Updated March 12, 2026
  • 3 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Use event input information

    The Event Input pane in the Event Rule designer helps ServiceNow customers reference and use event data when creating or customizing event rules and alert content. It displays key event fields and expressions that can be dragged into alert output fields to tailor alert messages. This pane is available across most sections of the Event Rule designer and supports transforming raw event data into meaningful alert information.

    Show full answer Show less

    Key Features

    • Event Input Pane Sections: Includes Event Additional Info (default and custom event fields for alerts), Expressions (user-created transformations from event data), and Event Raw Info (original event form fields).
    • Transform and Compose Alert Output: Allows drag-and-drop of fields and expressions from the Event Input pane to customize alert content and define alert-specific tags.
    • Edit Modes:
      • Standard Edit Mode: Allows field name selection and transformation without editing text directly.
      • Regex Edit Mode: Enables direct editing of text using regular expressions to extract or transform data, though undo is not available.
    • Expression Creation: Customers can create new fields by selecting text in event data and associating it with field names to use in alerts.
    • Field Visibility and Ordering: Use the exclusion list (emeventruleblacklist) to hide fields and the emeventruleorder form to set display order in the Event Rule designer panes.
    • Automation Options: Use Ignore automation to filter irrelevant alerts and Enrich automation to standardize alert data for improved response.

    Practical Application for ServiceNow Customers

    This capability enables customers to precisely control which event data appears in alerts and how it is presented, improving alert relevance and clarity. By leveraging the Event Input pane, customers can:

    • Create customized alert content tailored to operational needs.
    • Transform raw event data into actionable, standardized alert fields.
    • Apply filtering and enrichment to reduce noise and improve alert quality.
    • Configure field visibility and order for streamlined event rule design and alert readability.

    Overall, this functionality supports more effective event rule configuration, helping teams respond to alerts with better context and precision.

    The Event Input pane that is included in the steps to create an event rule provides a reference to the information that you can use when configuring an event rule.

    In the Transform and compose alert output pane, you can also drag the information into the required fields to customize alert content. The fields in the right-hand pane appear as a reference to which fields, expressions, and their values are available when working in the Event Rule designer. The fields that display in the Transform and compose alert output left-hand workarea become the fields in the generated alert form. In addition, you can define alert tags that are specific for customization.

    Note:
    To automatically filter out irrelevant alerts or transform and standardize alert data for better response, you can also use Ignore automation and Enrich automation.

    General components and navigation

    The Event Input pane consists of these sections:

    • Event Additional Info
    • Expressions
    • Event Raw Info

    The Event Input pane displays in all Event Rule designer sections, except for the Event Rule Info section. The fields in the right-pane can be modified only in the Transform and compose alert output section. In all the other sections, the Event Input pane is read-only and available for reference purposes.

    Note:
    If Accessibility enabled Accessibility enabled is selected in System Settings, standard edit mode is not available Standard edit mode icon.

    Edit modes

    Mode Description
    Standard edit mode Event Management icon Text selected in the left-hand workarea cannot be edited. Undo is not available. In this mode, you can only mark the text or values and transform it by selecting a field name.
    Regex edit modeEvent Management icon Edit text in the left-hand workarea by selecting it, as required. After you have edited the text, you cannot go back to the standard mode. Undo is not available. However, Reset is available, returning the field to its original value. You can compose text using regular expression (regex) format conventions, for example, type (.*) to create a field name. You cannot use field values like: type "$" to include the value of a field and specify the name of the field in parentheses {}.

    You can include special characters in a field by "escaping" them, that is, by prefixing the character with a "\". For example, to include a "\" in your text, enter "\\".

    Event additional info

    The Event additional info section displays default event form fields, plus fields that were created to display in alerts and that are added to the Additional information section of the alert.

    When configuring text in the fields in the left-hand workarea, you can drag field names and/or their value from this section into the fields.

    Expressions

    The Expressions section is available only if an additional information field was created. You can create expressions from event raw data or from additional information data.

    1. Click in a field in the Event Input pane to perform transformation actions.
    2. Create an expression by transforming information and associating it with a field name. Either select a field name from the suggested list, or create a field name, as required.

      Event Management rule expression

    3. Click in a field in the Event Input pane. In the left-hand workarea, select the required information.

    Create expressions by transforming information and associating it with a field name. Select a field name from the suggested list, or you can create a field name, as required.

    Event raw info

    The Event raw info section is always available. Its contents are the fields from the Event form.

    To transform text, click a field in the right-panel to open it in the work area on the left-panel, in the Mark Expressions section. You can select text in the Mark Expressions section where the selected text becomes the value of a newly created field. Name the new field. This new field is added to the Expressions section.
    Note:
    When creating regex expression for input, ensure that you create input with the variables in sequential order. While variables can be skipped for inclusion, the selected order must be maintained.
    Controlling how fields appear:
    • Use the exclusion list [em_event_rule_black_list] table to hide fields from the right-pane.
    • Use the em_event_rule_order form to order the position of each field.
    • Fields that are not in the exclusion list and also not part of the em_event_rule_order table, still appear in the event rule designer, in the right-panel and in the Transform and Compose Alert Output tab.