major incident trigger rule

[SM123]

Hi all,

what is trigger rule for "P1 incident lasting more than 30 mins"

i tried "Priority is 1-critical AND created relative after 30 mins from now".

but it's not working. could anyone help?

[Robbie]

Hi @SM123,

It is...

A quick point to note. The 'Major Incident Trigger Rule' is exactly that with the keyword trigger. The rule will trigger on update of the record. 

Update the 'Description' field or similar (making sure the conditions still match) and you'll see the Incident promoted (or proposed depending on what you have set) to a Major Incident.

To help others (or for me to help you more directly), please mark this response correct by clicking on Accept as Solution and/or Helpful.

Thanks, Robbie

[SM123]

HI @Robbie ,

it was really helpful but is there any ServiceNow product documentation which supports your theory because my lead says it should not work like that. Again, updating an incident it should not be the case.

[Robbie]

Hi @SM123,

Check the below SN Documentation link and specifically the point - "Major incident trigger rules are evaluated asynchronously each time an incident is created or updated provided the following conditions are met:

• The incident record doesn't have the Parent Incident populated, which means that the current incident isn't a child incident.
• The major incident isn't proposed or accepted.
• The incident is active.

When I've tested on my PDI, these are only triggered when an Incident is created or updated. There is no job running int eh background checking for these - however you could implement one - however you need to consider the performance aspect.

Have you seen the trigger rule run without an update or on initial creation?

o help others (or for me to help you more directly), please mark this response correct by clicking on Accept as Solution and/or Helpful.

Thanks, Robbie

https://docs.servicenow.com/bundle/washingtondc-it-service-management/page/product/incident-manageme...

[SM123]

HI @Robbie 

yes trigger rule runs for "created at or after last 30min" this one run just after creation of an incident it will be proposed as major incident candidate. we don't have to update again

[Robbie]

Hi @SM123,

Step back and think about it logically..... 

"created at or after last 30min" will always run. You're effectively checking if the incident was created in the last 30 minutes, which of course as it's just been created, it will always execute.

As stated above, you could change this to "created at or before last 30min" however the rule looks to only execute if the incident has a further update and the conditions are met, so in your case, an update has been made at or after 30 mins of the initial creation.

If you want this automated, I would suggest having a scheduled job that runs in the background every 30 mins and checks for any incidents that meet the criteria and updates the incident to Major rather than the trigger rule.

To help others (or for me to help you more directly), please mark this response correct by clicking on Accept as Solution and/or Helpful.

Thanks, Robbie