Is there an automatic way to stop alarms from showing ONLY after a Service Now ticket has been assigned to our user for the sngtw?
Although the alarm suppression will allow us to only see 1 alarm in UMP/IM (and show *** events), it is still filling up our database and creating emails each time!
Could we somehow stop alarms after the original email/service now ticket is sent without disabling the profiles?
It is not possible to prevent the new alarms coming in if a ServiceNow ticket was previously created.
However, you can prevent the display of alarms if a ServiceNow ticket is linked to it using a Filter in the IM Alarm console.
Value: ![INC[A-Za-z0-9]]* (regex for ServiceNow Incident #, so to not "!" show anything with a Service Now ticket).
As for the emails, that may depend on how you configured the emailgtw probe.
Is it emailing on every alarm or only on assignment?
Yes the emails are on every alarm. So if a service/application goes down for 5 hours, the NOC and customer will receive an email of the alarm every x minutes for 5 hours.
Thanks you so much for the input and script sample!