How to create a ServiceNow report on incidents that have changed state from On Hold to In progress

[Snehal13]

How to create a ServiceNow report on incidents that have changed state from On Hold to In progress in last 2 hours

[ABHAY_M]

hello @Snehal13 

you can make use metrics instance to get the report have this report.

resources that may help you https://youtu.be/cBRmS7UxHIU?si=A2T-PVSmHkxlYfkd

[AndersBGS]

Hi @Snehal13 ,

 you should be able to create a metric definition for this.

If my answer has helped with your question, please mark my answer as accepted solution and give a thumb up.

Best regards

 Anders

[PrashantLearnIT]

Hi @Snehal13 

To create a ServiceNow report that shows incidents that have changed their state from On Hold to In Progress within the last 2 hours, you need to leverage the Audit History or System Logs (sys_history_line table). These records track state changes on incidents.

Here's a step-by-step guide to create the report:

Steps:

1. Create a Report:

   • Navigate to Reports > Create New.

2. Choose the Source Table:

   • In the report configuration, for Table, select Audit [sys_audit].
     • The sys_audit table stores changes made to any record, including state changes.

3. Configure Conditions:

   • Set up the filter to identify incidents with state changes from On Hold to In Progress in the last 2 hours.

   • Set the following conditions:

     • Document Table is incident (This ensures that we are only checking state changes on the Incident table).
     • Field Name is state (This filters changes related to the state field).
     • Old Value is On Hold (This ensures the state was previously "On Hold").
     • New Value is In Progress (This ensures the state was changed to "In Progress").
     • Time Stamp is on or after javascript:gs.minutesAgo(120) (This ensures the state change happened in the last 2 hours).

4. Choose Report Type:

   • Select the type of report you prefer, such as List, Bar Chart, or Pie Chart.

5. Select Columns to Display (if List Report):

   • You may want to display the following columns in the report:
     • Document Key (This is the sys_id of the Incident, you can also fetch Incident number using a related table).
     • Old Value (To show the previous state).
     • New Value (To show the new state).
     • Time Stamp (When the state change happened).
     • User (Who made the state change).

6. Run and Save the Report:

   • Click on Run to view the report.
   • Save the report and give it an appropriate name (e.g., Incidents with State Changed from On Hold to In Progress (Last 2 Hours)).

Example of the Filter Conditions:

• Document Table: incident
• Field Name: state
• Old Value: On Hold
• New Value: In Progress
• Time Stamp: on or after javascript:gs.minutesAgo(120)

This report will track and show all incidents where the state was changed from On Hold to In Progress within the last 2 hours.

[Snehal13]

When I try above steps and have sys_audit table, nothing is available under filters. Could be ACL issue as I am not an instance admin

Any other alternative ?