I forgot to mention that I want to compare for every month over the last 12 months, without having to create 12 reports.

Btw: Your report would not be correct, because the incidents that are both created and closed this month would only be added to the 'not active' part and they should be contained in both parts.