Documentation forSolarWinds Service Desk


Incidents include any unexpected disruption to a service, thereby disrupting the normal operations and affecting end user’s productivity. This can occur due to a number of factors such as an asset malfunction or network failure.

Incident examples include:

  • Printer issue

  • wifi connectivity issues

  • Email service issue

  • Laptop crash

  • AD authentication error

  • File sharing issue etc.

There is a great deal of data provided in each Index page therefore we have divided this topic into subcategories to help you process the information.

Below you will find links to each subcategory. You can review them in the order provided or simply click on the subcategory to go directly to the topic of interest.

Incident Index Table

The Incidents index table will reflect All Incidents by default or you can click here to learn more about how to filter, edit and customize your view to best meet your needs.

To learn more about views, click here.

Understanding the columns in the Incidents table:

As mentioned above, it is important to review how to filter, edit and customize your table to provide the information most relevant to your needs. You can display:

  • SLA breaches and SLA warnings prior to next breach
  • The State of the Incident - The State can be updated directly from this view
  • Last Assignee change at - Shows the timestamp of the last assignment/reassignment

  • Last State change at - Shows the timestamp of the last State change

  • # of reassignments - Shows current count of reassignments

  • Incident/Service Request indicates whether the record is an Incident or Service Request. This is useful for sorting the Incident Index and when exporting for reporting purposes
  • Site to help with automating tickets
  • and so much more can all be viewed from this table.

It is important to take a moment to review all the column options to determine which details you would like to see in the Incident Index table.

Best practices:

To assist with Service Monitoring, it is recommended to filter via:

  • First assigned at - Filter the Incident Index by the time records were first assigned
  • First response - Filter the Incident Index by the time records were first responded to
  • Open during - Filter the Incident Index by incidents that were open during the time frame you want to review.

Let’s review additional features and actions you can utilize directly from this table:

  1. Triage the ticket
    1. In-line edit - when hovering over any column you can edit the information directly from this view.

      For example: Hover over the State to reveal the dropdown menu and change from ‘New’ to ‘Assigned’, “on Hold’ etc.

    2. The eagle eye icon allows you to preview the ticket details. By hovering over the eagle eye a new window will open, if you click on the eagle eye a pane will open on the right side of the screen with additional details.
  2. Comment in ticket
    1. Input a private (internal use only - not displayed to end user) or public (visible to everyone) comment by simply clicking on the lock/unlock icon.
    2. @ (at mention) individuals and/or teams to have an email automatically sent to them.
    3. Notice the rich text for editing directly from the Incident.
    4. By selecting the icon you can attach a file from your computer, dropbox or an existing solution. This assists agents in providing faster service.
    5. You can send information directly to the end user by clicking on the icon. Please make sure the comment is public. Private comments will not be shared.

  1. Agent collision

    1. If more than one agent is in the same ticket, you will see avatars of the additional agents viewing the ticket.

  2. Attachment of solutions

    1. When you attach a solution in the comment section, the comment is automatically added to the right pane as well. 

    2. When you attach directly in the right pane, the information is used for relationship building.

  3. Adding solutions

    1. As IA becomes familiar with your account, you will find “smart suggestions” to additional related tickets.

The last column on the Incidents index page, titled Sentiment, is important to notice as it is used to guide the IT technician in how to proceed. The Sentiment uses AI to determine level of agitation of the requester. If the requester is already agitated, then best to give this incident priority and resolve as soon as possible.

Icons on your Index Screen

In addition to all the features listed above, notice the five button icons on the upper right corner of the screen.  These icons are found throughout your SWSD on the following screens: Incidents, Problems, Changes, Releases, Solutions and Service Catalog.  A subset of these icons are on the CMDB screen as well.

  1. icon - In-context search. By entering keywords such as New, Assigned, Resolved etc. you can limit your search to reflect only Incidents in the respective states.
    1. There are a number of ways to hone in on your search, type:
      • * at the end of a word to search results containing the specified letter sequence
      • Description:gmail for all incidents with gmail in the description
      • State:New for all new tickets
      • To identify a specific user you can:
        • Requester:first name to search for specific requester
        • Assignee:first name to search for specific assignee
        • comments:first name to view in sent and received comments

        If you have enabled any filters within your in-context search, this will limit your search to only items that match the filter criteria.

  2. icon - Allows you to create a new incident and/or attached a Problem, Change CI etc.

    • To learn more about creating a New Incident, click here.
  3. The Actions button serves multiple purposes:
    1. Select and open the dropdown menu. From here you can:

      • Mass Update
      • Login History
      • Import
      • Export via CSV, XML, PDF and more

    2. To review information of a specific Incident, click the Incident title to reveal the details page.
      Here too, you will find the button and from here you can:

      • Merge
      • Clone
      • or Export the Incident to PDF

      When you select PDF Export, a menu appears that allows you to select which tab/s you want to export.

      For example:

      • Details tab
      • Comments tab
      • Related tab etc.
  4. icon reveals additional information and a tutorial on how to better understand your tasks.

Now let's look at individual Incidents. Select an Incident name from the Incident Index page.

This reveals a new window with Incident details such as Name and any additional information entered about the Incident created.

On the right pane of the screen, you will find associated details such as:

  • SLA
  • Service Monitor (For more information click here)
  • Related Items
  • and many more connections.

Creating a New Incident

Once you open the New Incident window we recommend you enter all the details requested.  Then press to save your information. Take notice, your New Incident form is intuitive and interactive. Most fields provide a user friendly drop down menu and many factors have been taken into account to ensure the incident is resolved as smoothly as possible by gathering all relevant details as soon as the form is completed.

Actions Available Directly from the Incident

Directly from this form, you can utilize the details provided in the tabs such as, Comments, Details, Related etc. to gain further insight into the Incident.

For example:

  • In the Comments tab -
  • In the Related tab, and click Actions to reveal a dropdown menu. When you select Changes, and a new window appears where you can choose from approved CCI templates to streamline and accelerate Change Requests and execution of Incidents.

Understanding Incident Routing in your SWSD

Incident routing is an imperative action that can be automated by your Service Desk. Automatic assignment of incidents created, will save time by ensuring all incidents are visible to the most appropriate team/service agent as quickly as possible to begin addressing the issue at hand.

As the Administrator, you can set up rules to route Incidents based on a variety of factors. Below we provide examples of common use cases:

Route tickets based on:

  • Account Default Assignee
  • Sites
  • Departments
  • Categories
  • Subcategories
  • Service Catalog Default Assignees
  • Automations

Setting Up Incident Routing

Select the most appropriate path, to ensure fast and efficient handling of each Incident routed through your SWSD.

Account Default Assignee

A default assignee can be selected for all new incidents created. This is most beneficial when un-categorized tickets are created in the system from incoming emails.

Default Assignee and Notifications

You can select a default assignee to receive notifications upon creation of each new incident.

Sites or Departments

If you determine the best route is for a ticket to go to a specific site or department, you can select it as a default path. For example:

  • Site - All Incidents originating from the New York office get routed to the New York site.
  • Department - Regardless of location, all IT related Incidents will get routed directly to the IT department.

You can select a default Site or Department when creating a new site/department or when editing an existing record.

Category or Subcategory

You can set the category or subcategory as a key word that determine the best route for an Incident.

For example:

  • Whenever the category is desktop, this ticket will be assigned to the IT Helpdesk

Service Catalog Default Assignee

A Default Assignee can be selected for each Service Catalog item created. This can be selected when creating or editing each item.

Automation Rules

We have provided a number of default assignments that can route tickets quickly and efficiently. You can set up multiple automation rules and the ticket will undergo a quick filter once created in the system. The latest rules will take precedence and if no rule applies, the ticket remains unassigned.