“How can I use SCORCH to link Parent Incidents with Child Incidents?” seems to be a common question that I get a lot. So I decided to write a quick post on this topic. In this example I will use two Incidents that will be linked together, but you can of course modify this basic procedure for your own need. The only requirements are that you have SCSM and SCORCH up and running together with the SCSM Integration Pack.

First, I created 2 Incidents by using the console.

Because 1 Incident (IR1793 – Outlook cannot connect to Exchange Server) is a direct result of Incident 2 (IR1795 – Exchange Server down), it can make sense to link them together. This is especially the case when more and more users start calling Service Desk because they cannot use Outlook anymore.

The procedure to get to the result is as follows:

1. Declare one Incident (IR 1795) as a Parent Incident
2. Add Child Incident (IR 1793) to the Parent Incident

This is how the runbook could look like.

Initialize Data

Here I configure the runbook parameters. In this example I use two parameters, one is the ID of the Incident that will become the parent, the other one is the ID that will become the child.

Get Object (Incident 1)

Now we have to get the Incident Object that will become the parent from the Service Manager database. Use class “Incident” and filter based in on the ID. Use published data from “Initialize Data”.

Get Object (Incident 2)

Same as previous, but this time we will get the Incident Object that will become the child.

Update Object (Incident 1)

The next activity will mark one Incident (IR1795) as the parent Incident. For this we must use Published Data and get the SC Object GUID of Incident 1. Then we update the property “is parent” to “true”.

Create Relationship

As a last step, we can link the Incidents together. In the “Create Relationship” activity we have to select the source and target class (in this case “Incident” for both) as well as the relationship type “Has Parent Work Item”. To make sure the correct objects are linked together we must again use published data (SC Object GUID) to define the source and target object. The source is the SC Object GUID of the Child Incident, the target the SC Object GUID of the parent Incident.

That’s it. Now I’m going to test the runbook in the runbook tester.

After a successful run, the Incidents should be linked as expected.

Now have fun building your own solution. Maybe one that can link multiple Incidents to the same Parent Incident at the same time?

Cheers
Marcel