Recurrent incidents

[Nenad Berbatovi]

Hi, 

I would like to have a % of recurrent incidents (and outages) per month. How can I do it easily (without calculate it manually)?

Best regards,

Nenad

[pr8172510]

Hi Nenad,

Good question — this is a common reporting requirement, and you can definitely achieve it without manual calculation.

---

1. First, define what “recurrent incident” means
ServiceNow doesn’t calculate this out-of-the-box, so you need a clear definition. Common approaches:

• Same CI + Short description
• Same CI + Category/Subcategory
• Linked to Problem record (best practice)

 If you’re already using Problem Management, this becomes much easier.

---

2. Recommended approach → Use Reporting with indicator flag

Create a flag field like:

• u_recurrent (True/False)

Populate it using:

• Business Rule OR
• Scheduled Job

Logic example:

• If similar incident exists in last X days → mark as recurrent

---

3. Create a report for % calculation

Now build a report:

• Table: Incident
• Filter: Created on → This month
• Group by: Month

Create 2 reports:

1. Total incidents
2. Recurrent incidents (u_recurrent = true)

Then use:

• Report → Single Score / PA Widget
• Or Performance Analytics

---

4. Best approach → Use Performance Analytics (recommended)

If you have PA:

• Create Indicator 1 → Total Incidents
• Create Indicator 2 → Recurrent Incidents
• Create Formula Indicator:

(Recurrent Incidents / Total Incidents) * 100

This will automatically give you monthly % trend.

---

5. Alternative (quick method without scripting)

If you don’t want custom logic:

• Use Problem association
• Consider incidents linked to same Problem as “recurrent”

Then:

• Report on incidents with Problem != empty
• Compare vs total

---

6. Visualization

Use:

• Time series (monthly trend)
• Single score (current month %)
• Breakdown by CI / Category

[GlideFather]

Hi @Nenad Berbatovi,

how do you define recurring incident? Is it an incident with the same category raised by the same person or how do you tell what is it? Or reopened ones?

Imagine oyu have 50000 incidents - tell me which ones are recurring...

Based on knowing the criteria we can suggest the next steps, currently it is not clear what you want to achieve.