Replicate Spiceworks Hashtags in Service Manager with Orchestrator

I’m not sure if its laziness, a product of being “too busy,” or brilliance but people seem to love Spiceworks hashtag system. For those of you not aware, Spiceworks allows your helpdesk analysts to email the ticketing system with a # and a word or words behind it to automatically have it close and assign to a specific person and even categorize the ticket. At my last job they had just migrated from Spiceworks to Service Manager a few months prior to me starting and I was asked if I could come up with a similar system in Service Manager. I was also recently at a client where they are considering changing from Spiceworks to Service Manager and I was told it would have been a complete show stopper if that functionality was not in Service Manager. One of the guys I was working with even acted like this was basic functionality all ticketing systems have. I have worked with Helpstar, ServiceNow, and Service Manager and to my knowledge none of them have this capability.

Well, Service Manager may not be capable of this by default, but never fear, we have Orchestrator, which really can do almost anything but make me coffee. (I don’t drink coffee so that’s fine by me)

Here are our runbooks, which I will step through. If you are going to follow along, I would recommend creating each of these runbooks as blank runbooks with just the Initialize Activity in them and the IR GUID variable. These runbooks will also be available for download at the end of the post.

1.1 Monitor Incident Creation from Email – Monitors Service Manager for new incidents created from email, filtering for descriptions containing #Flag, which passes off to the 1.2 #Flag Master Runbook.

1.2 #Flag Master – Our Master Runbook which invokes the other runbooks.


1.3 Assign Category – Assigns category of the ticket should the analyst specify one. Looking for #category

1.4 Assign User – Assigns the Incident to a user should it be specified. Looking for #assignto

1.5 Resolve Incident – Sets the incident to Resolve should it contain #Close

 1.1 Monitor Incident Creation from Email
First we need to grab the Monitor Object Activity from the Service Manager Integration Pack. In its properties, we select our Service Manager Connection, select Incident for Class, select New for trigger and add a Filter of Source Equals Email.


Next bring down the Invoke Runbook Activity and connect the Monitor Email Activity to it. Once connected, right click on the link and select properties. Select Exclude and select Add.  Select the title of the first activity and replace it with Description, then select equals and select does not contain and then put in #Flag. This is going to filter every ticket out except for tickets that have #flag in the description of the ticket. The hashtag is not case sensitive.


 Next on the Invoke Runbook activity select the Flag Master runbook if you have it created, if not add it later. Subscribe to the SC Object GUID from the Monitor Email Activity.



1.2 #Flag Master
For our Flag Master runbook we’ll drag over a Initialize Data Activity and add IR GUID or SC Object GUID if you so prefer.


Next drag a Get Object Activity from the Service Manager Integration Pack. We will select Incident and Add a filter of SC Object GUID and subscribe to the GUID from Initialize Data.


Now drag a Invoke Runbook Activity and connect it from the Initialize Data Activity. Once connected click on the link and select Exclude. Add more filters as seen below for #close, #assignto and #category (these tags can be anything you want, I am just going with what the client wanted) these are here in case some thoughless analyst sent in an email with #flag in the body but didnt add any other flags, we wouldn’t want our runbooks running for now reason and causing an error when it cant find the correct data.


Now on our Invoke Runbook Activity select the Ellipses and select the Assign Category Runbook and subscribe in the IR GUID to SC Object from Get Incident.


And do the same with Assign Incident


And Resolve Incident.

Lets talk about the theory behind these next runbooks for a second. The client wanted quite a lot of categories and users to be able to assign incidents to. We cant use the Map Published Data Activity because the source has to match exactly what is put into the source for Map Published Data, meaning even if nothing else was in the email except for the flags it still would never work because we have multiple flags between #Flag, #assignto, #close and #category. 
The second option would be to branch out and do link filters. This would work if you only had a handful of options, but it quickly goes from this to ridiculous really quick.
The only obvious solution was PowerShell -match, which I will show in the next two runbooks.
1.3 Assign Category
If you haven’t already, create your Assign Category Runbook and drag the Initialize Data Activity to it. Create the IR GUID published data variable.


Now drag the Get Object Activity from the Service Manager Integration Pack and connect it to the Initialize Data Activity. Select Incident for the Class and add a filter for SC Object GUID and subscribe to SC Object GUID from Initialize Activity.


Now drag a Run .Net Activity and connect it to Get Incident from the previous step. This is where you need to have planned out what you want your helpdesk analysts to be able to hashtag. the cool part is in Service Manager you have Applications as its own category and you have say Citrix if you hashtag #citrix it puts the incident under applicationscitrix automatically.

So we will create a variable in powershell called flag and set it equali to the description field of our incident. As such:

$flag = “subscribe to description from incident”

We will then do an if and a -match, and if powershell finds the match it will set the result to that specific category.

if($flag -match “#category application”){$result = “applications”} 

Note: these categories should match directly to your categories in Service Manager, otherwise the next step will fail.


Dont forget to go into Published Data and create your Result variable.


For the next step we drag over the Update Object Activity from the Service Manager Integration Pack. Again we will add Incident for our Class and subscribe to the SC Object GUID from Get Incident. In the Fields Pane select Optional Fields and select Classification Category, then subscribe to Result from the Get Category Run .Net Activity.





We then return the data back to the master runbook.


1.4 Assign User
For assign user we’re going to do the same steps as before with reading the ticket description for a hashtag and then do a match in PowerShell. The trick here is the $result needs to be the SamAccountName of the user you want to assign the ticket to. The flag can be anything you want, as long as you have the samaccountname.


We then take the result and get that Active Directory user in Service Manager.


We then assign the user to the ticket.


Return Data and we’re done.

1.5 Resolve Incident

This is the simplest of the hashtags. Again we get the incident.


Get UTC time with Powershell.


And resolve the incident.

This runbook is provided as an example and is not production ready, please test in your own environment.  The runbook is provided as is and without warranty.

The runbook can be downloaded from here

Hi, I’m Billy York.  I’m a Cloud and Datacenter Engineer, specializing in monitoring and automation. Here you’ll find posts about System Center Operations Manager, Powershell, Hyper-V, Azure Automation, Azure Log Analytics and other Microsoft related technologies.