Difference between Child Incidents and Incident Tasks

[manpreetkaursay]

Currently in our instance, agents can create both Incident Tasks as well as Child Incidents on an Incident. We need to get a better understanding into the differences between the two, the use cases both of these serve, is it best to keep both enabled?

[Jaspal Singh]

Hi Manpreet,

To simplify Child incidents are incidents which are related to a same/common or Parent Incident.  

An Incident Task is a task where something needs to get done in relation to existing incident.

[Martin Ivanov]

Both have their application

- child incidents: imagine that you have a broken router that cannot serve internet access to a bunch of servers. You got an incident for the router and you got incidents that the servers are unreachable. An agent sees the relation and understands that the issues with the servers are caused by the issue with the router. Then all the incidents related to servers get attached to the incident for the router as child incidents.

- incident tasks - these are created in order to facilitate some activities for the disgnosis and resolving the issue.

For more information, go through the docs https://docs.servicenow.com/bundle/rome-it-service-management/page/product/incident-management/concept/c_IncidentManagement.html

Please Mark Correct AND Helpful. Thanks!

[Sanjay Bagri1]

Hi Manpreet,

Below are the difference.

Incident : "These occur when there is disruption of service operation causing impact to business operations.". Basically incident is an unplanned interruption or degradation of quality. Incident raised by end user or customer, if customer phase any issue then they share there problem through INCIDENT and the purpose of incident management is restore service as soon as possible.

Child Incident : If we have raised an Incident for unable to submit the request from portal. then again we have find some more issue while submitting the request so it will come under child incident because it's related to the Main incident.

Incident Tasks - Used to track break the incident into sub-tasks that can be assigned to different teams to perform investigation/root cause analysis and help restore the customer operation successfully as soon as possible.

For ex: An Incident with disruption of internet services can have Incident tasks assigned to network and hardware teams to track the root cause.

Please mark my answer correct and helpful.

Thanks

Sanjay Bagri

QBrainX Pvt. Ltd.

[Sourabh26]

Hi,

Below is a simple way you can understood the difference.

Ex. Suppose a Server goes down due to CPU utilization. Now there are 2 different application (SQL & Tableau) are hosted. As the server goes down then both the application are also affected and goes down.

INC00001 --> (Parent Incident) Incident created for the Server goes down and need to up again. 

INC00002 --> (Child Incident 1) Application (SQL) down due to Server down.

INC00003 --> (Child Incident 2) Application (Tableau) down due to Server down.

Now these are the Parent and child incident relationship. When we talk about Incident Task then these are the steps to resolve the issue and get it fixed to ASAP to have the service back and running again.

Ex. For INC00001 the Incident Task are -

INCTSK01 --> Check the server CPU utilization.

INCTSK02 --> If there are other services running then kill the service to get the server back and running.

INCTSK03 --> Restart all the services again.

Similarly for child incident too there are Incident Task which was specific to that incident only. These task has been work upon to get the incident resolved.

Hope you got some clarity now. 

Mark this as Helpful/Correct if Applicable.

Regards,

Sourabh