major incident trigger rule

SM123 · ‎02-26-2024

Hi all,

what is trigger rule for "P1 incident lasting more than 30 mins"

i tried "Priority is 1-critical AND created relative after 30 mins from now".

but it's not working. could anyone help?

Robbie · ‎02-29-2024

The short answer (based on my testing via a PDI and this statement in the Docs): No

The conditions are only evaluated on creation and update - this means in order for this rule to trigger, an update would have to happen (or when the incident is created) and the conditions to equal true.

For example - if the incident is updated 1 hour after, or several hours after - only when an update has taken place will the rule be evaluated and triggered regardless of the condition of 'created' at or before 30 mins ago.

As mentioned, you can either select the Propose Major Incident on creation, or have this controlled via a scheduled job.

To help others (or for me to help you more directly), please mark this response correct by clicking on Accept as Solution and/or Helpful.

Thanks, Robbie

View solution in original post

Robbie · ‎02-26-2024

Hi @SM123,

To answer your question directly, change the 'relative after 30 mins from now' (which is based in the future so logically this will never trigger) to 'relative before 30 mins ago' (However again, this use case could still never be triggered)

I question these broad rules and would definitely test and re-test. For example, what happens if a ticket was created a week ago and now the priority is just updated to Critical - do you want this to create a Major Incident?

I'd suggest rather than using the created date, make sure you check the Incident is active, Priority is Critical and it has updated at or before last 30 mins for example.

(Again, I stress to test this with the business/stakeholders before pushing up to higher environments)

To help others (or for me to help you more directly), please mark this response correct by clicking on Accept as Solution and/or Helpful.

Thanks, Robbie

SM123 · ‎02-26-2024

Hi, @Robbie

Updated i can't use i guess because sometime system also updates a incident.

actually, what they asked me is if priority 1 incident is created you give them 30 mins time to resolve if no one resolves it then after 30 min it should be proposed as major incident candidate.

let's assume we are using this trigger for only present created incidents. then in that case can i use

Priority is 1 critical AND created relative after 30 min ago. but the problem is this trigger is not waiting for 30 mins its proposing major incident just after priority 1 incident is created. could you help me with this?

Robbie · ‎02-28-2024

Hi @SM123,

Change the condition as follows:

'Created' - 'at or before' - 'Last 30 mins'

Please note. You may want to add a few additional conditions so this rule doesn't pick up any other existing older incidents. I would recommend:

'Active' - 'True'

'Created' - after a certain date as your feature flag as to when this rule should start working from

To help others (or for me to help you more directly), please mark this response correct by clicking on Accept as Solution and/or Helpful.

Thanks, Robbie

SM123 · ‎02-28-2024

is it working for you?