Querying/Filtering Incidents by When They Were First Updated

[taylorbarber]

We'd like to be able to list incidents that were updated within a certain amount of time of being created. Using the normal filters, this isn't possible as the Updated and Updated By fields only keep track of the most recent update. I thought there might be a way to use the data from the Time Worked table for a solution, but I'm not sure how to go about combining information from both the Incident and Time Worked tables to output a list. Would I use a scripted filter?

Am I correct in that this is probably the best way to go about doing it? Or is there another method that would yield the same result? Any help would greatly be appreciated.

[Michael Fry1 · Accepted solution]

What about setting up a Metric on the Incident table > State field (or maybe another field) that will capture when the sys_mod_count = 1? Then you could report on the results?

Try this:

if (current.sys_mod_count == 1)

  createMetric();

function createMetric() {

  var mi = new MetricInstance(definition, current);

  if (mi.metricExists())

      return;

  var gr = mi.getNewRecord();

  gr.start = current.sys_created_on;

  gr.end = current.sys_updated_on;

  gr.duration = gs.dateDiff(gr.start, gr.end);

  gr.calculation_complete = true;

  gr.insert();

}

[gyedwab]

Either a metric like the one above, or a similar business rule that automatically populates a "First Updated" time-stamp that you can report against.

Using the Time Worked table, you can have a query (like this one using Explore Analytics) that compares the Time Worked created to the Task.Created, but ServiceNow doesn't support any granularity below 1 hour after.

[randrews]

we did something similar but in   a different approach..

we defined an SLA with our customers that incidents would be assigned to someone within 2 hours of being received then created an SLA for that... this lets it be tracked and makes it easy to report on as an sla... you could do something similiar by checking for updated different than created

[taylorbarber]

Our team has decided to create a new calculated field in the tickets to keep track of this in the future. Thanks for all of the responses, those will also help with this in the future!