Documentation forSolarWinds Service Desk


Your SWSD is a management tool to help maintain order within your organization. Tickets are opened daily and fit under two classifications:

  • Incidents

  • Service Requests

Let's begin with a definition.

Incidents include any unexpected interference to a service, thereby disrupting the normal operations and affecting end user’s productivity. This can occur due to a number of factors such as an asset malfunction or network failure.

Incident examples include:

  • Printer issue

  • wifi connectivity issues

  • Email service issue

  • Laptop crash

  • AD authentication error

  • File sharing issue etc.

This section includes a great deal of data, therefore, we have divided this topic into subcategories to help you process the information.

Getting to know your SWSD Incidents

Below you will find links to each subcategory. You can review them in the order provided or simply click on the subcategory to go directly to the topic of interest.

Incident Lifecycle from Creation to Resolution (or Closed)

There are several ways to open an incident such as:

  • Via the user portal
  • Email
  • Import from Orion
  • or even if you catch your IT professional in the hall and he provides you assistance, once he returns to his work station, he can open an incident and immediately close it however by documenting the issue and resolution you are able to maintain organized Incident management.

Once an incident is created, the ticket will go through several states in your SWSD before it is considered closed or resolved. It is imperative to understand the definition of each state to most effectively address the issues contained in the incidents.

State Definition
  • Agent Creation - (Phone call, walk up, Skype etc) Here, your technicians will creatie Incidents on behalf of SolarWinds users that called or walked over to IT to report an issue.
  • Email - (Most common form of Incident creation) Effective way for your end users to submit Incidents. It is highly recommended to make sure you Incident forms requires all vital information to begin addressing the issue and prevent time consuming back-and-forth correspondence requesting additional data.
  • Orion - All Incidents coming through the Orion platform will be entered as an email Incident.
  • Service Portal - Enables end users to submit Incidents and Service Requests via custom service forms to obtain all relevant details upfront for quick and seamless resolution of tickets.
  • Groups - A collection of users from the same functional team (IT, Finance, HR etc). When assigned to a group, you ensure that no ticket goes unnoticed or delayed if an agent is on vacation or working on other matters. Once a ticket is assigned within a group, it can be reassigned as needed.
  • Incident Routing - Automatic assignment of incidents created, will save time by ensuring all incidents are visible to the most appropriate team/service agent as quickly as possible to begin addressing the issue at hand. For more on Ticket Routing, please click here.
  • Filtering - Once Incidents appear on the Incidents Index page, you can filter incidents to view reports relevant to your needs such as: Category, Assigned to, State.
In Progress

This state is relevant only once the Incident has been assigned and an agent is actively working on resolving the issue at hand.

  • Comments - Can be public (including your end users) or Private (only internal team members will have access to private comments) .
  • Creating Relationships - Attaching relevant assets, problems, solutions etc to the current Incident.
  • Updating States - Escalated to Vendor, Awaiting Input and more.
Awaiting User

Once you have reached out to the user via the Incident, use this state to reflect that you are awaiting a response before you can proceed with the incident.

  • Recommended to automate the process to ensure that as soon as a public message is received in an Awaiting Progress state, the state is automatically returned to In Progress.

This reflects that the Incident has been addressed to the best of the agents ability. A public comment should be entered to let the end user know the issue has been resolved. A resolution code and comment needs to be entered as well.

  • Resolution Code - A phrase describing how a ticket was resolved (also used for reporting purposes).

    When resolving a ticket with related incidents attached, you will be offered to add this resolution code to all relevant incidents.

    Navigate to your related tab to attach this code to all related incidents.

  • Resolution Comment - Agents summary of how issue was resolved (can be used to solve future similar incidents).

Important to differentiate that closed does not mean resolved. This state should be used in a number of ways such as:

  • Agent requests more information and the requester did not respond over an extended period of time.

At times, closed tickets can be reopened (by the agent). If requester continues to experience a challenge, they need to open a new ticket.

Factors to consider:

  • What is the most efficient flow through your service desk?
  • How can you ensure tickets don't get overlooked?
  • Do the out-of-the-box states address all the needs of your organization or does it benefit you to create custom states as well?

Best Practices

  • Incident creation should be an automatic process such as via email or the service portal, however a new incident can evolve from several origins (See table below).
  • Encourage an organizational environment that utilizes submission of Service Requests whenever possible rather than break fix Incidents.
  • Set up queues to automatically route your Incidents to the correct group or agent (While a ticket is in the queue, it is awaiting assignment).
  • Created relationships among relevant areas of your SWSD. Connect Incidents with similar issues, previous helpful solutions, useful Knowledge Based articles and more to enhance the end user experience.
    • Attach laptop incidents to their respective assets. The historical record of the associated previous incidents provides justification for replacing a piece of equipment.
  • We recommend automating the update of ticket states when possible. For example:
    • While a ticket is Awaiting Input (this means we are waiting for the requester to provide more details), we want to ensure that as soon as a public message is received, the ticket state should automatically return to In Progress.
  • Auto-close inactive tickets. If the ticket has awaited a response from the requester for a significant amount of time (5-7 business days), set the state to closed.

Incident Index Table

The Incident Index page is an accumulation of all Incidents in your SWSD. This can include incidents opened via the SWSD customer portal, email and/or integrations such as Orion. For more on Integrations, please click here.

The Incidents index table will reflect All Incidents by default or you can click here to learn more about how to filter, edit and customize your view to best meet your needs.

To learn more about views, click here.

Understanding the columns in the Incidents table:

As mentioned above, it is important to review how to filter, edit and customize your table to provide the information most relevant to your needs. You can display:

  • SLA breaches and SLA warnings prior to next breach
    • There is a great deal analyze from this information, for additional SLA details, please click here.
  • The State of the Incident - The State can be updated directly from this view
  • Last Assignee change at - Shows the timestamp of the last assignment/reassignment

  • Last State change at - Shows the timestamp of the last State change

  • # of reassignments - Shows current count of reassignments

  • Incident/Service Request indicates whether the record is an Incident or Service Request. This is useful for sorting the Incident Index and when exporting for reporting purposes
  • Site to help with automating tickets
  • and so much more can all be viewed from this table.

It is important to take a moment to review all the column options to determine which details you would like to see in the Incident Index table.

Best practices:

To assist with Service Monitoring, it is recommended to filter via:

  • First assigned at - Filter the Incident Index by the time records were first assigned
  • First response - Filter the Incident Index by the time records were first responded to
  • Open during - Filter the Incident Index by incidents that were open during the time frame you want to review.

Let’s review additional features and actions you can utilize directly from this table:

  1. Triage the ticket
    1. In-line edit - when hovering over any column you can edit the information directly from this view.

      For example: Hover over the State to reveal the dropdown menu and change from ‘New’ to ‘Assigned’, “on Hold’ etc.

    2. The eagle eye icon allows you to preview the ticket details. By hovering over the eagle eye a new window will open, if you click on the eagle eye a pane will open on the right side of the screen with additional details.
  2. Comment in ticket
    1. Input a private (internal use only - not displayed to end user) or public (visible to everyone) comment by simply clicking on the lock/unlock icon.
    2. @ (at mention) individuals and/or teams to have an email automatically sent to them.
    3. Notice the rich text for editing directly from the Incident.
    4. By selecting the icon you can attach a file from your computer, dropbox or an existing solution. This assists agents in providing faster service.
    5. You can send information directly to the end user by clicking on the icon. Please make sure the comment is public. Private comments will not be shared.

  1. Agent collision

    1. If more than one agent is in the same ticket, you will see avatars of the additional agents viewing the ticket.

  2. Attachment of solutions

    1. When you attach a solution in the comment section, the comment is automatically added to the right pane as well. 

    2. When you attach directly in the right pane, the information is used for relationship building.

  3. Adding solutions

    1. As IA becomes familiar with your account, you will find “smart suggestions” to additional related tickets.

The last column on the Incidents index page, titled Sentiment, is important to notice as it is used to guide the IT technician in how to proceed. The Sentiment uses AI to determine level of agitation of the requester. If the requester is already agitated, then best to give this incident priority and resolve as soon as possible.

Icons on your Index Screen

In addition to all the features listed above, notice the five button icons on the upper right corner of the screen.  These icons are found throughout your SWSD on the following screens: Incidents, Problems, Changes, Releases, Solutions and Service Catalog.  A subset of these icons are on the CMDB screen as well.

  1. icon - In-context search. By entering keywords such as New, Assigned, Resolved etc. you can limit your search to reflect only Incidents in the respective states.
    1. There are a number of ways to hone in on your search, type:
      • * at the end of a word to search results containing the specified letter sequence
      • Description:gmail for all incidents with gmail in the description
      • State:New for all new tickets
      • To identify a specific user you can:
        • Requester:first name to search for specific requester
        • Assignee:first name to search for specific assignee
        • comments:first name to view in sent and received comments

        If you have enabled any filters within your in-context search, this will limit your search to only items that match the filter criteria.

  2. icon - Allows you to create a new incident and/or attached a Problem, Change CI etc.

    • To learn more about creating a New Incident, click here.
  3. The Actions button serves multiple purposes:
    1. Select and open the dropdown menu. From here you can:

      • Mass Update
      • Login History
      • Import - Especially during the onboarding phase, proper import allows you to easily transfer existing data into your SWSD.
        • Select the Import button
        • Choose a file

        • Map the fields in the source file to the corresponding target attributes.

        Prerequisite for importing custom fields data: The custom fields should be defined in our system prior to import.

      • Export via CSV, XML, PDF and more

    2. To review information of a specific Incident, click the Incident title to reveal the details page.
      Here too, you will find the button and from here you can:

      • Merge
      • Clone
      • or Export the Incident to PDF

      When you select PDF Export, a menu appears that allows you to select which tab/s you want to export.

      For example:

      • Details tab
      • Comments tab
      • Related tab etc.
  4. icon reveals additional information and a tutorial on how to better understand your tasks.

Now let's look at individual Incidents. Select an Incident name from the Incident Index page.

This reveals a new window with Incident details such as Name and any additional information entered about the Incident created.

On the right pane of the screen, you will find associated details such as:

  • SLA
  • Service Monitor (For more information click here)
  • Related Items
  • and many more connections.

Creating a New Incident

Open a New Incident window and enter all the details requested. 

As soon as you begin entering information in the Incident title, notice the AI list that appears on the right of your screen:

  • Similar Incidents - A direct link to all incidents that have similar key terms
  • Smart Solutions - A direct link to all solutions that have worked in the past

This helps you quickly and efficiently address the issue without needing to wait for agent intervention.

If you are unable to resolve the issue on your own, then complete the requested details and scroll to the tabs on the bottom.

  • The related tabs is a simple way to attach related ITSM objects to current Incident which allows you to:
    • Consolidate resolution of tickets - When you resolve the main ticket you’re working on, you will be given the option to resolve all attached incidents.
    • Escalate to a problem or a change - You may have noticed a larger trend with the incoming tickets and may want to escalate to a problem or a change. Attach the common tickets and create a problem or change record from the incident record to build the hierarchy of the escalation.
  • The Tasks tab is used setup a workflow to resolve the issue.

Identifying Redundant tickets:

Sometimes users submit the same ticket more than once. The AI built into your SWSD recognizes such duplicates and highlight to allow you to consolidate the effort of resolving the ticket.

Once you have entered all the information you have, press to save your information. Take notice, your New Incident form is intuitive and interactive. Most fields provide a user friendly drop down menu and many factors have been taken into account to ensure the incident is resolved as smoothly as possible by gathering all relevant details as soon as the form is completed.

Actions Available Directly from the Incident

Directly from this form, you can utilize the details provided in the tabs such as, Comments, Details, Related etc. to gain further insight into the Incident.

For example:

  • In the Comments tab -
  • In the Related tab, and click Actions to reveal a dropdown menu. When you select Changes, and a new window appears where you can choose from approved CCI templates to streamline and accelerate Change Requests and execution of Incidents.

Understanding Incident Routing in your SWSD

Incident routing is an imperative action that can be automated by your Service Desk. Automatic assignment of incidents created, will save time by ensuring all incidents are visible to the most appropriate team/service agent as quickly as possible to begin addressing the issue at hand.

As the Administrator, you can set up rules to route Incidents based on a variety of factors. Below we provide examples of common use cases:

Route tickets based on:

  • Account Default Assignee
  • Sites
  • Departments
  • Categories
  • Subcategories
  • Service Catalog Default Assignees
  • Automations

Setting Up Incident Routing

Select the most appropriate path, to ensure fast and efficient handling of each Incident routed through your SWSD.

Account Default Assignee

A default assignee can be selected for all new incidents created. This is most beneficial when un-categorized tickets are created in the system from incoming emails.

Default Assignee and Notifications

You can select a default assignee to receive notifications upon creation of each new incident.

Sites or Departments

If you determine the best route is for a ticket to go to a specific site or department, you can select it as a default path. For example:

  • Site - All Incidents originating from the New York office get routed to the New York site.
  • Department - Regardless of location, all IT related Incidents will get routed directly to the IT department.

You can select a default Site or Department when creating a new site/department or when editing an existing record.

Category or Subcategory

You can set the category or subcategory as a key word that determine the best route for an Incident.

For example:

  • Whenever the category is desktop, this ticket will be assigned to the IT Helpdesk

Service Catalog Default Assignee

A Default Assignee can be selected for each Service Catalog item created. This can be selected when creating or editing each item.

Automation Rules

We have provided a number of default assignments that can route tickets quickly and efficiently. You can set up multiple automation rules and the ticket will undergo a quick filter once created in the system. The latest rules will take precedence and if no rule applies, the ticket remains unassigned.

Converting Incidents into a Service Request

At times, requesters open an incident rather than submitting a service request.

When you come across such an issue, it is simple to correct this matter.

Click the link or review the steps below:

  1. From your Incident Index page, select the relevant incident and click on the incident title.
  2. Click Actions in the upper right hand corner and select Convert to Service Request from the dropdown menu.

  1. Select the relevant Service Request and click Next
  2. The Convert to Service Request window appears. When you hover over this window, you can move it around to uncover relevant data on your main screen. This allows you to copy and paste needed information from the original Incident into the new Service Request.
  3. Click Convert

    The Incident number will not change to ensure all relevant people subscribed to the original incident will continue to get relevant notifications