Create trigger rules for Major Incident

[deesha]

I need to create a trigger rule for major incident with following conditions. 

1. CI is one of {a,b,c,d,e,f,g}

2. Incident created in last 15 mins.

3. Total count of incidents is > 10. 

I can do filter condition for CI but where to code for other 2 conditions? scheduled jobs? business rule?. their is no option for scripting into trigger rules? Please suggest me how to build these conditions. 

[Jeff Currier]

I don't think you can create that trigger rule with the simple conditions in the MI Trigger rule form.  

I found a similar lab from Knowledge 18 which might give you some ideas. This lab used event management and flow designer to create a major incident.  I think you can borrow some ideas from this and use flow designer, triggered every 15 minutes to use the advanced logic in Flow Designer to get results for your three conditions (get count of incidents with any of these affected CIs and where the the incident was created in the last 15 minutes.  If the count is > 10, then create the Major incident or create a proposed major incident.

[deesha]

Hi Jeff,

Our problem statement is to find where if a CI has had 10 P1 Incidents opened against it in the last hour then open a major incident. To find it in flow designer where I need to write script? 

Thanks

[Jeff Currier]

I just built a prototype.  Easier than I thought.

Add an action to look up records.  There you put in your filter (CIs, Priorities, open time, etc)

Then add the if where count > 10

then add the create MI candidate or create MI.

Here is a screenshot.

[deesha]

Hi Jeff,

Thank you so much for your reply. please see two attachments. I completely understand filters and created into first attachment. 

For condition, see other attachment, highlighted with yellow color, can I write script in that field? I need to create Major incident if tickets are opened more than 10 with one particular CI. In the first attachment, I have selected 3 CI's in condition filter and if their are more than 10 incidents opened with "3com NIC dignotitics" then I need to create Major incident with this CI. My question is where I write this logic into workflow? 

Thank you so much for all your help.

Thanks,
Dronika