major incident trigger rule

[SM123]

Hi all,

what is trigger rule for "P1 incident lasting more than 30 mins"

i tried "Priority is 1-critical AND created relative after 30 mins from now".

but it's not working. could anyone help?

[SM123]

Hi @Robbie 

it's not working either. i have made some scenarios in which 2nd scenario should work as it is working when applied in incident list view. but it's not working in trigger rule.

[Robbie]

Hi @malika123,

My latest esponse seems to have been hidden in the thread. See here.

Step back and think about it logically..... 

"created at or after last 30min" will always run. You're effectively checking if the incident was created in the last 30 minutes, which of course as it's just been created, it will always execute.

As stated above, you could change this to "created at or before last 30min" however the rule looks to only execute if the incident has a further update and the conditions are met, so in your case, an update has been made at or after 30 mins of the initial creation.

If you want this automated, I would suggest having a scheduled job that runs in the background every 30 mins and checks for any incidents that meet the criteria and updates the incident to Major rather than the trigger rule.

To help others (or for me to help you more directly), please mark this response correct by clicking on Accept as Solution and/or Helpful.

Thanks, Robbie

[SM123]

Hi Robbie,

You highlighted "Major incident trigger rules are evaluated asynchronously each time an incident is created or updated " in the previous reply could you please elaborate more.

So there is no trigger rule which will trigger after waiting for 30 mins unless it is updated again?

[Robbie · Accepted solution]

Hi @SM123,

The short answer (based on my testing via a PDI and this statement in the Docs): No

The conditions are only evaluated on creation and update - this means in order for this rule to trigger, an update would have to happen (or when the incident is created) and the conditions to equal true.

For example - if the incident is updated 1 hour after, or several hours after - only when an update has taken place will the rule be evaluated and triggered regardless of the condition of 'created' at or before 30 mins ago.

As mentioned, you can either select the  Propose Major Incident on creation, or have this controlled via a scheduled job.

To help others (or for me to help you more directly), please mark this response correct by clicking on Accept as Solution and/or Helpful.

Thanks, Robbie

[SM123]

Hi @Robbie 

You mean to say "P1 incident lasting more than 30 mins" it comes under "UPDATE" case. Thank you for helping me.