Once Incident is Resolved, the Closed field is taking up the Resolved date. This should not happen.!

[AbdurRahmanSnow]

Good morning.
An Incident was "Resolved" on 30-07-2025 20:27:09, and the State was later auto-changed to "Closed" on 06-08-2025 20:30:50

But the "Closed" field is showing as "30-07-2025 20:27:07".

How is this possible?
The "Closed" field should have the date of when the State got changed to "Closed", and not of "Resolved".
How is this happening? Please help. This is only happening for few incidents.

Also, for the user, the "Closed" field is greyed-out (read-only). He cannot change it manually. How did this happen?

I just found a Business rule. Not sure, if this is causing. Please help.

________________________________________________________________ 

                                         

@Ankur Bawiskar @Dr Atul G- LNG @Viraj Hudlikar 

[Rafael Batistot]

Hi @AbdurRahmanSnow 

This is a normal behaver of tool 

See this article that explain better 

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0552820

basically in the base system, Incident Management automatically closes incidents 1 day after they have been resolved if no updates are made to the incident. This helps incident closure by automating the Resolved -> Closed state transition. If the record is updated on any field, then the 1 day counter is reset to the last updated timestamp. (Please note that Major Incidents are not part of auto-close functionality out-of-the-box.) 

[Dr Atul G- LNG]

Hi @AbdurRahmanSnow 

In the first case, the incident moved from Resolved to Closed as per the incident property of 7 days. However, I think the close date is being set to the resolved date due to a specific Business Rule. Did you get the same issue on other incidents as well, or only on this one? Try checking a few more cases so the investigation can be done better.