Documentation forSolarWinds Service Desk

Service Level Management

This Service Level feature allows you to define service targets for SWSD. By establishing service level agreements (SLAs), you can monitor, alert, and report on missed SLA targets.

Creating a New SLA

To create a new SLA click the Add icon and define your new SLA rule. Review the image below. The description of each field is located below the image.


Name. Create a name indicative of the service level you want your internal service providers to adhere to. Ensure the names are easy to differentiate from other SLAs to help with reporting.

Define Target. Define the operations you expect your service agent users to take within an allotted period of time. The targets include:

  • Not assigned

  • Not commented

  • Not resolved

  • No actions taken

  • No state change 

In addition to choosing a target, you can set the SLA to follow your organization’s business hours by selecting Use Business Hours.

You can also elect to suspend the SLA timer during certain states of inactivity. For example, if an incident is in the state Awaiting Customer Input you may not want that incident to breach the SLA.

Define Scope. Here you define whether the SLA applies to All, Incidents Only, or Service Requests Only. You can also define category and subcategory when defining an SLA.

Create an SLA rule once and define category and subcategory by using a multi-picklist. This allows you to apply the same rule to multiple category/subcategory combinations.

Set Action. An action allows you to define the priority and assignee. Here you can send a notification prior to an SLA breach. Using the drop-down menu, in addition to sending a notification to a specific user, you can select to include a notification to the assignee's manager and the manager's manager as well.

Calculating SLAs

You can ensure that SLA hours are best calculated to meet your company goals. For example:

  • The SLA work day is measured by average business hours. If you provide support three days a week at 8 hours/day and two days a week at 6 hours/day, an SLA measured by business hours equals 7.2 hours/day.

    If your business hours are set to 7 am - 5 pm Sunday through Friday, the average business day is 10 hours and excludes weekends. If a ticket is created at 9:30 am on Friday, October 8, the ticket will not breach until 9:30 am on Monday, October 11. That's because October 9 and 10 fall on Saturday and Sunday, and they are not business days.

  • If you have set multiple breach times, the counter will reflect the most recent relevant breach (up to 3 breaches).
    Updated and/or newly created incidents do not get updated with a newly defined SLAs. That is, as you define new SLAs, they will only be relevant to incidents created after the SLA is defined.
  • The time zone for SLA compliance is set by the site of the incident. If there is no site, SWSD looks at the organization's default time zone. See Organization for more information.

Set Timer Indication Threshold

In an SLA, you can select two alert triggers to warn you before an upcoming breach.

The first indicator provides the Initial Pre-Breach Indication.  From the drop-down menu, select whether you would like the first warning minutes, hours, or days prior to the breach.  The Final Pre-Breach Indication offers the same selection options. 

The Indicator Time Threshold ensures you have sufficient time to address the incident prior to an SLA breach.

The pre-breach display reflects the actual business time until breach (based on site or account).

It is important to take into account factors that can influence the report outcomes. For example, the time zone of the incident or the work hours. SWSD looks at the time zone according to the site of the incident. If there is no site associated with the incident, the default time zone established for your organization will be used.

Examples of factors that can influence report outcomes

Case 1: Sites with different business hours

Incident A, within site 123, has regular business hours set to Mon-Fri 8:00-17:00.

Incident B, within site 456, has an SLA with no business hours defined or it has all-day marked for all days.

If both breach at about 1 day, Incident A will show 9 hours, and Incident B will show 24 hours.

A very small change in breach time can cause the sort to be: B (24h) and A (9h).

The sort is still accurate, but it is important to take this detail into account.

Case 2: Incidents with different time zones

Incident A is within a site using a USA timezone. Breach will be reflected the beginning of the next work day.

Incident B has no site selected. It will use Jerusalem (the default account time zone) and breach in 3 hours.

In Israel it is 9 am.

The sort will be: B, A (since B will breach sooner).

But the display will be out of order: B (3h), A (0m)

This sort is accurate, but it is important to understand the cases above to determine how to best proceed in resolving incidents to avoid SLA breaches.

Define Scope

After you’ve determined the target, you can make your SLA rules more granular by refining specific filters. This helps you offer varying service levels as they pertain to different internal service providers and priorities. Filters can be scoped for the following:

  • Incident / Service Request

  • Category

  • Priority

  • Site

  • Department

  • Requester

Set Action

Setting actions helps you define automatic actions to be taken if the target is breached. You can define one or multiple actions to take place. These actions can include:

  • Change priority

  • Re-assign incident

  • Send notification to

  • Add Tags

To set an action, navigate to the All Open Incidents index page (image below). This is fully customizable to meet your needs.  By default, the screen will display as shown.

The SLA Breaches and Next Breach columns show color-coded timers for each incident.

  • Green Timer. Reflects incident has not met the pre-breach criteria.

  • Orange Timer. Reflects incident that is past the initial pre-breach indicator, but has not reached the final pre-breach indicator. 

  • Red Timer. Reflects incident that risks breaching pre-determined SLAs.

You can set different thresholds based on the importance of the specific SLA. For example, assume you have two similar Not Resolved SLAs. One is for VIP users, the other is for the general public.

In both cases, the SLA will be breached after three days, but for the VIP case, you have included an additional trigger to escalate to the IT manager.  Therefore, in the VIP SLA, you can set the initial threshold indicator to alert at two days prior to breach and the final threshold indicator to one day. For the general public SLA, you can set it with the initial indicator threshold at one day and the final indicator threshold at five hours prior to breach. 

The goal is to build the SLA pre-breach indicators to best benefit your teams.  By setting the thresholds as described above, the indicators keep your teams better informed prior to any breach of SLAs, and they provide ample time to perform the necessary actions to resolve any issues and prevent a breach.  Via the Incident Index page, agents can sort their queues based on which tickets will breach next, helping them prioritize the tickets and reduce breached incidents, and ensuring your VIP cases receive your services within the agreed-upon time frames.

All SLAs Index Page

After you have created the SLAs for your organization, you can view them all in the All SLAs Index page.

You can also customize your view by using:

The down arrow to filter. Examples of filtering options include:

  • Enabled
  • Disabled
  • Logged in in last 30 days

The ellipsis offers you the ability to view your options. Examples of options include:

  • Edit
  • Share your view with others
  • Save Changes

When you select Edit View, a column appears in the left pane of your screen where you can:

  • Filter via specific attributes, for example, Active Account or Department.
  • Select the columns for your index page and the order in which you would like them to appear.
  • Sort, for example, by Name, Email, or Role.

Related Topics

Business Hours

Reports