Why use stop time rather than resolved?

[mgromacki]

I have two Indicator Sources that I am using that I believe to be OOTB, they are as follows: 

and

What exactly is stop time? And why would OLA use this metric, and not SLA? 

[Mark Stanger]

'Stop time' is the time that the SLA ended.

https://docs.servicenow.com/bundle/kingston-it-service-management/page/product/service-level-managem...

As far as why it is attached to the OLA vs. the SLA there is no functional difference whatsoever between those two in the system (SLA type is simply a label).

[mgromacki]

In terms of best practice for reporting on SLA and OLA, would it be more effective to track stop time as opposed to resolved time?

[Mark Stanger · Accepted solution]

I would use Stop time because 'Resolved' can be changed.  If you have an incident that gets resolved, it could potentially be reopened by the caller.  In that case, the 'Resolved' stamp would be overwritten the next time the Incident was resolved.

With SLA reporting, you really need to do everything on static data so that you can get accurate reporting and metrics.  This is why most incident resolution SLAs have pause conditions to subtract out the time between 'Resolved' and 'Closed'.  'Closed' is the only point where you could have everything complete and calculate an accurate SLA.  This is also when 'Stop time' would be stamped on your SLA.

[Brian Lancaster]

Since you are using the incident_sla table which like a view of the task_sla and incident table the resolved time is most likely coming from the incident table and not the SLA table.