How to create an incident record

You should create an incident record when you cannot complete a request because of a business service failure, or when there is an internal interruption in service.

Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

Permissions: Your user role must have the permission to create an incident.

From the main menu, select Run > Incident > Incidents. Service Management displays a list of all incidents.

Click New. Service Management displays a New Incident form to gather basic information. Service Management does not assign an incident ID until you save the incident record.

Complete the Incident details section.

This section contains basic information about the incident that helps to accelerate resolution. The description becomes resource information when you search for similar incidents and potential solutions. The more detail that you provide, the easier it is to match new incidents with resolved incidents.

The Service points to an actual service that is defined by Service Asset and Configuration Management.

You must set the Business impact and Urgency of the incident. Business impact describes the global effect on the user community. Urgency describes how important the issue is for the end user. Service Management uses the urgency and impact values to calculate the incident resolution priority.

Field	Description
Title	The title is a summary of the issue presented by the end user. If you omit a title, Service Management uses the beginning text from the Description field. Best Practice: Choose a meaningful, descriptive, and relatively short title. Titles are often the only identification used in selection lists and in other areas to identify components. Service Management displays the title at the top of the form when you edit or display the complete record.
Description	The description captures the details of the incident. You can also capture information that might not fit well elsewhere. For example, if the location and telephone number are different from the contact details, you can record the correct information in this field. Service Management may automatically recognize CIs whose details are entered here. See CI Detection - Automatic recognition of CIs.
Impact	Impact describes the global effect on the user community. Consider whether the incident affects the entire enterprise, a business unit, or an individual. Valid values are: Enterprise Site or department Multiple users Single user The default selection is Single user. Example: Choose Enterprise if the problem affects the entire organization or a critical business unit. Single user is the lowest impact.
Service	Services are usually related to one of the following: Infrastructure. For example, database or network services. Business services. For example, email or a web portal. Note At the top of the list of services Service Management displays smart suggestions, based on the text entered in the Title and the Description fields.
Urgency	The urgency indicates how important the issue is for the service recipient. If there is an outage or a mission-critical outage, the urgency might be Critical. Valid values are: Total loss of service Severe disruption Slight disruption No disruption Example: Choose Total loss of service if there is an outage that directly affects the basic infrastructure, such as network services. Slight disruption is the default selection. It indicates the problem does not need immediate resolution. The end user can provide guidance for these settings because it is how they perceive the impact and urgency within their organization.
Category	The category describes the type of incident. The default categories are based on best practice recommendations for service-related processes. They reflect how the incident is assigned and help to organize reporting metrics. Note At the top of the list of categories Service Management displays smart suggestions, based on the text entered in the Title and the Description fields.
Reported by	Service Management assigns your name (the logged in user) to this field. You can change it. For example, you are opening the incident on behalf of another user and you want their name to appear.
Incident model	A model defines specific steps to be followed for a particular type incident. Choose a model if the new incident fits into an existing profile. For example, the simplest incident model might be for a password reset request. Note At the top of the list of models Service Management displays smart suggestions, based on the text entered in the Title and the Description fields.
Service desk group	A Service desk group is a pool of resources. The Incident Manager can choose a group to own the incident. One or more members of the group can work on the incident resolution.
Owner	The incident owner is responsible for the incident until it is resolved.
Assignment group	A Service desk group is a pool of resources. The Incident Manager can choose a group to own the incident. One or more members of the group can work on the incident resolution.
Assignee	The assignee is a member of the assignment group. The assignee is responsible for the incident resolution.

If you can provide an immediate solution for the incident, expand the Resolution section.

An immediate resolution is the shortest incident workflow. When the person who creates an incident can resolve an incident immediately, the incident does not have to go through the typical process of assignment, validation, and closure. Immediate resolution might be one of the following:

A solution applied to a similar incident
A published workaround
A solution documented in a knowledge article

Service Management uses the text that you provide in the Title and Description fields to launch a knowledge search as soon as you expand the Resolution section. Service Management searches for existing articles or other records that contain matching information. For example, if your description includes the words "email server down", Service Management searches for those words throughout the knowledge database. If a match occurs, the Suggested solutions link is displayed. Click the link to see the top three solution candidates. These matches can be any of the following record types:

Articles
User questions
External knowledge
Problems
Changes
Incidents

If you want to link one of the suggested solutions to this record, hover your mouse over the end of the solution entry to display action buttons. The buttons and actions vary depending on the type of potential solution record.

Click one of the buttons described in the following table.

Link to record type	Action	Result
Change Incident Problem Request	Link	Updates the list of related records on the Related records tab in both the current incident and the linked change, incident, problem, or request record.
Incident Problem	Copy + link	Copies the solution text from the referenced incident or problem into the Solution field of the current incident. Updates the list of related records on the Related records tab in both the current incident and the linked incident or problem record. Note If there is no prospective solution found, Service Management does not display this button.
Article	Copy link	Copies a link to an article into the Solution field of the current incident. Note Only articles that are in the External phase of the workflow are eligible to be solution links.
Q and A	Copy link	Copies a link to a question and answer into the Solution field.

If you want to search for other suggested solutions for the current incident, click Find more solutions at the bottom of the Resolution section.

Service Management inserts a search form at the top of the page where you can type a search argument to produce a complete list of potential solution matches. You can use "or," "and," or a wild card character to enhance your search argument.

All returned results appear in the left pane. If you select a record, the record details appear in the right pane. If you find a suitable match, do one of the following:

Click Copy solution to copy information from an incident or problem into the Solution field of the current incident.
Click Copy link to resolution to copy a link to an article or question and answer into the Solution field of the current incident.
Click Link as cause to add information about a change to the Related records tab in the Causes of the incident section of the current incident.
Click Link as effect to add information about a change to the Related records tab in the Effects of the incident section of the current incident.
Click Link as related to add information about a request to the Related records tab in the Causes of the incident section of the current incident.

Complete the Resolution section with as much information as possible.

Field	Description
Problem candidate	A checked box specifies that the incident has a root cause, and that it can be resolved through Problem Management processes.
Knowledge candidate	A checked box specifies that the solution details can apply to future incidents.
Solution	A detailed description of the resolution. If the solution is a knowledge or problem candidate, the solution description should be as specific as possible. If you linked an article, the link appears in this field. Service Management may automatically recognize CIs whose details are entered here. See CI Detection - Automatic recognition of CIs.
Completion code	The completion code describes the reason that you can close the incident. Example: In the case of immediate resolution, the completion code might be Resolved with workaround.
Closure category	The categorization of the incident as determined after the incident has been resolved. Select a value from the drop-down list.
Solved time	The time when the incident resolution was applied. There may be a delay between the actual resolution and its application. Select a date and time.
Suggested solutions	Click Suggested solutions to have Service Management suggest solutions, based on the information provided for the incident. If none of these are relevant, you can click Find more solutions to look for other solutions in the database.

To attach a file to the record, click Add attachment in the Attachments section. You may want to use this feature to add a log file, screen shot, or list of server errors to the incident.

Note

The following file formats are supported: jpg; jpeg; gif; png; doc; docx; ppt; pptx; xls; xlsx; pdf; txt; xml; zip; msg; sql; gz; rar; tar; 7z.
The maximum file size of an attachment is 10 MB.
If the Attachments field has been defined as encrypted for this record type and you are a member of an encryption domain, click Add encrypted attachments to attach an encrypted file to the record.
Attachments are not visible in the Service Portal.

Click Save.

Service Management displays the new record in the Incident record list.