SLA Analysis

Overview

This skill provides comprehensive SLA (Service Level Agreement) performance analysis for ServiceNow ITSM. It enables you to:

Detect SLA breaches and near-breaches in real-time
Calculate SLA achievement rates by service, priority, or time period
Analyze trends to identify systemic issues
Generate reports for stakeholder communication
Identify at-risk SLAs before they breach

When to use: For SLA compliance reporting, identifying performance issues, preparing executive summaries, or investigating breach patterns.

Prerequisites

Roles: sla_admin, itil, or report_admin
Access: Read access to task_sla, contract_sla, incident, and related tables
Knowledge: Understanding of SLA definitions and business impact
Data: Active SLA definitions must be configured in ServiceNow

Procedure

Step 1: Query SLA Status Overview

Get a snapshot of current SLA status across all active tasks.

Using MCP (Claude Code/Desktop):

Tool: SN-Query-Table
Parameters:
  table_name: task_sla
  query: active=true
  fields: sys_id,task,sla,stage,percentage,has_breached,business_time_left,planned_end_time
  limit: 100

Using REST API:

GET /api/now/table/task_sla?sysparm_query=active=true&sysparm_fields=sys_id,task,sla,stage,percentage,has_breached,business_time_left,planned_end_time&sysparm_limit=100

Step 2: Detect Breached SLAs

Identify all SLAs that have already breached.

Using MCP:

Tool: SN-Query-Table
Parameters:
  table_name: task_sla
  query: has_breached=true^active=true
  fields: sys_id,task,sla,stage,percentage,original_breach_time,business_time_left
  limit: 50

SLA Stage Values Reference: | Stage | Description | Action Required | |-------|-------------|-----------------| | In Progress | SLA timer running | Monitor | | Paused | Timer paused (awaiting user) | Review pause reason | | Breached | SLA has breached | Immediate attention | | Achieved | SLA met successfully | No action | | Cancelled | SLA no longer applicable | Review cancellation |

Step 3: Identify At-Risk SLAs

Find SLAs that are approaching breach (>75% elapsed).

Using MCP:

Tool: SN-Query-Table
Parameters:
  table_name: task_sla
  query: active=true^has_breached=false^percentage>=75
  fields: sys_id,task,sla,percentage,business_time_left,planned_end_time,stage
  limit: 50
  order_by: percentage
  order_direction: desc

Using REST API:

GET /api/now/table/task_sla?sysparm_query=active=true^has_breached=false^percentage>=75&sysparm_fields=sys_id,task,sla,percentage,business_time_left,planned_end_time,stage&sysparm_limit=50&sysparm_orderby=percentage&sysparm_orderbydesc=percentage

Step 4: Calculate Achievement Metrics

Query completed SLAs to calculate achievement rates.

Get Achieved SLAs (Last 30 Days):

Tool: SN-Query-Table
Parameters:
  table_name: task_sla
  query: active=false^has_breached=false^end_timeONLast 30 days@javascript:gs.daysAgoStart(30)@javascript:gs.daysAgoEnd(0)
  fields: sys_id,task,sla,end_time
  limit: 1000

Get Breached SLAs (Last 30 Days):

Tool: SN-Query-Table
Parameters:
  table_name: task_sla
  query: active=false^has_breached=true^end_timeONLast 30 days@javascript:gs.daysAgoStart(30)@javascript:gs.daysAgoEnd(0)
  fields: sys_id,task,sla,end_time
  limit: 1000

Calculate Achievement Rate:

Achievement Rate = (Achieved SLAs / Total Completed SLAs) * 100

Step 5: Analyze Trends by SLA Definition

Group metrics by SLA definition to identify problematic SLAs.

Query SLA Definitions:

Tool: SN-Query-Table
Parameters:
  table_name: contract_sla
  query: active=true
  fields: sys_id,name,collection,duration,schedule,relative_duration_works_on
  limit: 100

Query Breaches by SLA Definition:

Tool: SN-Query-Table
Parameters:
  table_name: task_sla
  query: has_breached=true^end_timeONLast 30 days@javascript:gs.daysAgoStart(30)@javascript:gs.daysAgoEnd(0)
  fields: sla,task,end_time
  limit: 500

Step 6: Generate Time-Based Trend Analysis

Analyze SLA performance over time periods.

Weekly Breach Count (Last 4 Weeks):

For each week, query:

Tool: SN-Query-Table
Parameters:
  table_name: task_sla
  query: has_breached=true^end_timeONLast 7 days@javascript:gs.daysAgoStart(7)@javascript:gs.daysAgoEnd(0)
  fields: sys_id,sla,task
  limit: 500

Repeat with daysAgoStart(14)@javascript:gs.daysAgoEnd(7) for previous weeks.

Step 7: SLA Performance by Priority

Analyze SLA achievement rates segmented by incident priority.

Join task_sla with incident data:

Tool: SN-Query-Table
Parameters:
  table_name: task_sla
  query: task.sys_class_name=incident^active=false^end_timeONLast 30 days@javascript:gs.daysAgoStart(30)@javascript:gs.daysAgoEnd(0)
  fields: sys_id,task,task.priority,sla,has_breached
  limit: 500

Expected Output Analysis: | Priority | Total SLAs | Achieved | Breached | Achievement % | |----------|------------|----------|----------|---------------| | P1 - Critical | 25 | 20 | 5 | 80% | | P2 - High | 150 | 135 | 15 | 90% | | P3 - Moderate | 400 | 380 | 20 | 95% | | P4 - Low | 200 | 198 | 2 | 99% |

Tool Usage

MCP Tools Reference

| Tool | When to Use | |------|-------------| | SN-Query-Table | Primary tool for querying task_sla and contract_sla tables | | SN-Natural-Language-Search | Natural language queries like "show breached SLAs this week" | | SN-Get-Record | Get details of specific SLA record |

REST API Reference

| Endpoint | Method | Purpose | |----------|--------|---------| | /api/now/table/task_sla | GET | Query active/completed SLAs | | /api/now/table/contract_sla | GET | Query SLA definitions | | /api/now/stats/task_sla | GET | Aggregate statistics |

Key Tables

| Table | Description | |-------|-------------| | task_sla | Individual SLA records attached to tasks | | contract_sla | SLA definitions (terms, duration, schedule) | | cmn_schedule | Business schedules for SLA calculations | | sla_condition_class | SLA start/stop/pause conditions |

Best Practices

Real-Time Monitoring: Check at-risk SLAs (>75%) at least twice daily
Root Cause Analysis: When breach rates increase, investigate by category and assignment group
Business Hours: Consider schedules; breaches during non-business hours may indicate configuration issues
Trending: Compare week-over-week, not just snapshots
Segmentation: Analyze by priority, category, and assignment group for actionable insights
ITIL Alignment: SLA management supports Continual Service Improvement (CSI)

Troubleshooting

"No task_sla records found"

Cause: SLA definitions may not be attached to the workflow or active Solution: Verify contract_sla records exist and are active; check SLA conditions match task criteria

"Inconsistent breach times"

Cause: Schedule not correctly applied or daylight saving time issues Solution: Review cmn_schedule configuration; check timezone settings

"Percentage shows over 100%"

Cause: SLA has breached but task remains open; percentage continues accumulating Solution: This is expected behavior; filter by has_breached=true for clear breach identification

"SLA not starting/stopping correctly"

Cause: Start/stop conditions not met Solution: Review sla_condition_class entries for the SLA definition

Examples

Example 1: Daily SLA Health Check

Objective: Morning check of SLA status

Step 1: Get breach summary

Tool: SN-Query-Table
Parameters:
  table_name: task_sla
  query: active=true^has_breached=true
  fields: task,sla,percentage,business_time_left
  limit: 20

Step 2: Get at-risk SLAs

Tool: SN-Query-Table
Parameters:
  table_name: task_sla
  query: active=true^has_breached=false^percentage>=80
  fields: task,sla,percentage,planned_end_time
  limit: 20

Output Summary:

=== SLA HEALTH CHECK ===
Date: [Today]

CRITICAL (Breached): 3 SLAs
- INC0012345 - Resolution SLA - 120% (P1)
- INC0012400 - Response SLA - 105% (P2)
- INC0012456 - Resolution SLA - 150% (P2)

AT RISK (>80%): 7 SLAs
- INC0012500 - Resolution SLA - 85% (2 hours remaining)
- INC0012501 - Resolution SLA - 82% (3 hours remaining)
[...]

OVERALL HEALTH: Needs Attention
Action: Escalate breached P1 incident immediately

Example 2: Monthly SLA Performance Report

Objective: Generate monthly executive summary

Step 1: Total SLAs processed

Tool: SN-Query-Table
Parameters:
  table_name: task_sla
  query: active=false^end_timeONLast 30 days@javascript:gs.daysAgoStart(30)@javascript:gs.daysAgoEnd(0)
  fields: sys_id,has_breached,sla
  limit: 2000

Step 2: Count by SLA type Process results to create summary:

=== MONTHLY SLA PERFORMANCE REPORT ===
Period: [Last 30 Days]

SUMMARY:
- Total SLAs Completed: 1,247
- Achieved: 1,185 (95.0%)
- Breached: 62 (5.0%)

BY SLA TYPE:
| SLA Definition        | Total | Achieved | Breached | Rate |
|-----------------------|-------|----------|----------|------|
| P1 Resolution (4hr)   | 45    | 38       | 7        | 84%  |
| P2 Resolution (8hr)   | 189   | 175      | 14       | 93%  |
| P3 Resolution (24hr)  | 512   | 498      | 14       | 97%  |
| P4 Resolution (72hr)  | 301   | 294      | 7        | 98%  |
| Response SLA (1hr)    | 200   | 180      | 20       | 90%  |

TREND (Week-over-Week):
Week 1: 96% achievement
Week 2: 95% achievement
Week 3: 94% achievement
Week 4: 95% achievement

RECOMMENDATIONS:
1. P1 Resolution SLA at 84% - below target; investigate root cause
2. Response SLA showing consistent underperformance - review staffing levels

Example 3: Breach Root Cause Analysis

Objective: Investigate why P1 Resolution SLA is underperforming

Step 1: Get breached P1 SLAs

Tool: SN-Query-Table
Parameters:
  table_name: task_sla
  query: has_breached=true^task.priority=1^sla.nameLIKEResolution^end_timeONLast 30 days@javascript:gs.daysAgoStart(30)@javascript:gs.daysAgoEnd(0)
  fields: task,task.number,task.assignment_group,task.category,task.short_description,original_breach_time,end_time
  limit: 50

Step 2: Analyze patterns

=== P1 RESOLUTION SLA BREACH ANALYSIS ===

BREACHES BY ASSIGNMENT GROUP:
- Network Operations: 4 breaches (57%)
- Application Support: 2 breaches (29%)
- Desktop Support: 1 breach (14%)

BREACHES BY CATEGORY:
- Network: 4 (57%)
- Software: 2 (29%)
- Hardware: 1 (14%)

COMMON PATTERNS:
1. 5 of 7 breaches occurred during night shift (11pm-7am)
2. Network issues taking longest to resolve (avg 6.2 hours vs 4hr target)
3. 3 breaches had multiple reassignments before resolution

ROOT CAUSE HYPOTHESIS:
- Insufficient night shift coverage for Network team
- Complex network issues exceeding 4-hour P1 target

RECOMMENDATIONS:
1. Add on-call network engineer for night shift
2. Review P1 network SLA target (consider 6-hour resolution)
3. Implement warm handoff procedures to reduce reassignment delays

Related Skills

reporting/executive-dashboard - Executive KPI generation
reporting/trend-analysis - Incident volume and pattern analysis
itsm/incident-lifecycle - Full incident management
itsm/major-incident - Major incident handling

sla-analysis