How Long Should ServiceNow Incidents Be Open For?
There is no “one-size-fits-all” answer here.
It depends on a) the type of incident b) it’s impact to the business c) the context of the IT organization that this incident is created d) IT Management
Many businesses don’t have any auto closure features, and that’s totally fine too.
The length of time that an IT incident should stay open depends on the specific incident and the steps required to resolve it. In general, the goal is to resolve incidents as quickly as possible in order to minimize the impact on users and business operations.
In order to determine how long an IT incident should stay open, it’s important to first assess the severity of the incident and the potential impact on business operations. For example, a minor incident that affects a single user may be resolved quickly, while a major incident that affects multiple users or critical business systems may require more time to resolve.
Once the severity of the incident has been assessed, the next step is to develop a plan to resolve the incident. This plan should outline the steps that need to be taken to restore normal business operations, as well as any additional resources or support that may be required. The length of time that the incident stays open will depend on how long it takes to implement this plan and restore normal operations.
In general, industry best practices for IT incident management include the following:
- Establishing clear protocols and procedures for handling incidents, including how to assess the severity of an incident and develop a plan to resolve it
- Providing regular updates to stakeholders and affected users throughout the incident resolution process
- Maintaining thorough documentation of the incident, including the steps taken to resolve it and any lessons learned
- Conducting a post-incident review to identify any areas for improvement and prevent similar incidents from occurring in the future.
Incidents tend to stay open, in relation to their urgency, impact and priority in an IT department.
When you have auto resolution measures in place, then you can keep your incident table up to date, relevant and it keeps incidents from getting stale and falling between the cracks.
Overall, the key is to respond to incidents quickly and effectively, with a focus on minimizing the impact on business operations and restoring normal operations as quickly as possible.
How To Auto Resolve Incidents, With No Updates In 5 Days
You can take the below script and modify it to fit your business needs.
It is probably a better idea to auto-resolve an incident versus auto-close an incident. Resolving an incident allows the end user to confirm and validate that the incident has been solved.
You will take this script, and put it into a Scheduled Job, that executes daily.
To update the state of an incident to resolved/closed in ServiceNow, you can use the update method on the incident table. This method can be called from a scheduled job that runs every 3 days to check for incidents that haven’t been updated in that time frame.
Here is an example of what the scheduled job might look like:
// Create a scheduled job that runs every day
var gr = new GlideRecord('incident');
// Get all incidents that are active and have no updates in 5 calendar days
gr.addEncodedQuery('sys_updated_onRELATIVELT@dayofweek@ago@5^active=true');
gr.query();
// Update the state of each incident that matches the query
while (gr.next()) {
gr.state.setDisplayValue('resolved'); // set the state here
gr.update();
}
This code creates a scheduled job that queries the incident table for records with a state that is not “closed” and an update date that is more than 3 days ago. For each record that matches the query, the code updates the state to “closed” and saves the updated record.
It’s worth noting that this code is just an example, and you may need to modify it to fit the specific requirements of your ServiceNow instance. For example, you may need to add additional query conditions or update additional fields on the incident record.
You should meet with your IT stakeholders to ultimately decide how long an incident should stay open for.
Regarding auto closing incidents, you should also take weekends and longer holiday breaks into consideration, as you want to make sure you’re not auto closing incidents, when people are off on a holiday.
Let us know what sort of auto closure settings you have.
