Teams can search ServiceNow incidents directly from Slack and share results in a channel or a direct message. Users choose state and priority in a simple Slack modal and get the top five recent matches. This fits daily triage, status checks, and quick updates.

An n8n webhook receives Slack events and parses the payload. The flow routes the event to open the modal, handle a submission, or respond to a button press with a quick 200 reply. After a submission, the modal closes and n8n queries ServiceNow for incidents that match the chosen state and priority. Results are sorted by most recent, limited to five, formatted for Slack blocks, combined into one message, and posted to the chosen channel or sent as a DM. If nothing matches, a clear notice goes out to the channel or user.

Setup needs a Slack app with rights to open modals and post messages, and a ServiceNow account with read access to the incident table. Expect faster triage, less context switching, and fewer copy paste errors. It works well for IT support teams, on call rotations, and managers who need quick checks in standups.

• Webhook capture of Slack events with fast acknowledgment to keep the interface responsive.
• Slack modal opened through the Slack API so users can pick state, priority, and a target channel.
• Modal closes cleanly after submission to give users instant feedback.
• ServiceNow incident search using user selected state and priority with a direct API query.
• Smart branching sends a clear notice when no incidents match, by channel or DM.
• Sorting by most recent and limiting to five results to keep messages readable.
• Looping and formatting turns each incident into Slack Block content and then combines it into one message.
• Delivery to a selected channel or as a direct message to the requester.

• Reduce incident search time from 5 minutes to 30 seconds
• Streamline triage by 60 percent with in Slack filtering and sharing
• Eliminate 90 percent of copy paste errors by pulling live ServiceNow data
• Handle five times more requests per hour with the same team
• Connect Slack and ServiceNow so teams do not switch tools

1. Import the template into n8n: Create a new workflow in n8n > Click the three dots menu > Select 'Import from File' > Choose the downloaded JSON file.
2. You'll need accounts with Slack and ServiceNow. See the Tools Required section above for links to create accounts with these services.
3. In your Slack workspace, create or select a Slack app with permissions to open modals and post messages. Add scopes to support posting to channels and DMs and opening views. Install the app to your workspace and copy the Bot User OAuth Token.
4. In the n8n credentials manager, create a Slack API credential. If unsure, double click any Slack node or the HTTP Request node that calls Slack, choose Create new credential, then follow the on screen instructions and paste your Bot User OAuth Token.
5. In ServiceNow, create an integration user with read access to the incident table. Note the instance URL, username, and password.
6. In the n8n credentials manager, create a ServiceNow Basic Auth credential with your instance URL, username, and password. If unsure, double click the ServiceNow node, choose Create new credential, and follow the on screen steps.
7. Open the Webhook node in n8n and copy the Test URL. In your Slack app settings, set the Interactivity or event request URL to this Webhook URL. Save changes.
8. Enable the workflow in n8n. In Slack, trigger the app shortcut or button that starts the search. You should see the modal open and accept inputs.
9. Submit a search with a common state and priority. Confirm you receive up to five recent incidents in the chosen channel or as a DM.
10. Test a search that returns no results. Confirm the channel or DM receives a clear no incidents found message.
11. If Slack shows a timeout or error, make sure the Respond to Webhook nodes are reached quickly and that your Slack app token is valid. Check that the Webhook node response mode is set to Response Node.
12. If ServiceNow results do not appear, verify the ServiceNow credential works, the incident table is accessible, and your state and priority values match those in your instance.