Your Problem Management Data Template
Your Problem Management Data Template
This is our generic process mining data template for Problem Management. Use our system-specific templates for more specific guidance.
Select a specific system- A universal framework applicable to any Problem Management system.
- Recommended data fields and process steps for comprehensive analysis.
- Foundational insights to begin your process mining journey efficiently.
Problem Management Attributes
| Name | Description | ||
|---|---|---|---|
| Activity Name ActivityName | The name of a specific event, task, or status change that occurred within the problem management lifecycle. | ||
| Description The Activity Name describes a single step in the problem management process, such as 'Problem Record Created', 'Root Cause Identified', or 'Permanent Fix Implemented'. These activities are recorded chronologically to build the story of how a problem was handled. For process mining, this attribute is critical for constructing the process map, which visually represents the actual flow of work. Analyzing the sequence, frequency, and paths of these activities helps uncover deviations, bottlenecks, and inefficiencies in the problem resolution process. Why it matters This attribute defines the steps in the process, enabling the visualization and analysis of the process flow, including common paths and deviations. Where to get Activity names are often derived from status change logs, audit trails, or event tables associated with the primary problem record. Examples Investigation StartedPriority ChangedWorkaround ProvidedProblem Record Closed | |||
| Event Time EventTime | The exact date and time when a specific activity occurred. | ||
| Description Event Time, or timestamp, provides the chronological context for each activity in the problem's lifecycle. It is essential for sequencing events correctly and for calculating durations between different process steps. In process mining, this attribute is used to order activities, discover the process model, and perform all time-based analysis. It is the basis for calculating key performance indicators like 'Avg Root Cause Investigation Time' and for identifying delays between steps, such as the handoff between identifying a root cause and initiating a change request. Why it matters The timestamp for each activity is crucial for ordering events and calculating all time-based metrics, such as cycle times and bottleneck durations. Where to get This timestamp is usually located in an event log or audit trail table alongside the activity name and case identifier. Examples 2023-04-15T10:22:05Z2023-11-20T14:05:30Z2024-01-08T09:00:11Z | |||
| Problem Record ID ProblemRecordId | The unique identifier for a problem record, which represents a single instance of the problem management process. | ||
| Description The Problem Record ID serves as the primary key for tracking the entire lifecycle of a problem from its creation to its final resolution. Each problem, which may be linked to multiple incidents, is assigned a unique ID to distinguish it from all other problems. In process mining, this attribute is fundamental as it defines the case, allowing the tool to group all related activities into a single process instance. Analyzing process flows, identifying bottlenecks, and calculating case durations all depend on the correct identification of each unique problem record. Why it matters This is the essential Case ID that groups all related events, making it possible to trace the end-to-end journey of each problem investigation. Where to get This identifier is typically found in the main problem or ticket table of the IT Service Management (ITSM) system. Examples PRB0040332PROB-1298778103PM-5501 | |||
| Last Data Update LastDataUpdate | The timestamp indicating when the data was last extracted or refreshed from the source system. | ||
| Description This attribute records the date and time of the most recent data pull. It provides transparency into the freshness of the data being analyzed, ensuring that stakeholders understand the time frame covered by the analysis. In dashboards and reports, this information is critical for context. It helps users know if they are looking at real-time information or a snapshot from a specific point in time, which affects the interpretation of metrics like 'Aged Problem Backlog'. Why it matters Provides crucial context on data freshness, ensuring that analyses and dashboards are interpreted correctly based on the last data refresh. Where to get This timestamp is usually generated and stored by the data extraction, transformation, and loading (ETL) tool or script during data ingestion. Examples 2023-10-01T06:00:00Z2024-02-20T08:00:00Z2024-03-15T05:30:00Z | |||
| Source System SourceSystem | The name of the application or system from which the data was extracted. | ||
| Description This attribute identifies the origin of the problem management data, for example, ServiceNow, Jira, or a homegrown ITSM tool. It is particularly important in environments where data from multiple systems is combined for a holistic analysis. In a process mining context, Source System can be used as a filter to compare process performance and variations across different business units or platforms. It also aids in data validation and troubleshooting by providing context about where the data originated. Why it matters Identifies the data's origin, which is crucial for data validation and for comparing processes across different systems or organizational units. Where to get This is typically a static value added during the data extraction process to label records from a specific source system. Examples ServiceNowJira Service ManagementBMC Helix ITSMFreshservice | |||
| Affected Service AffectedService | The primary business service, application, or configuration item (CI) impacted by the problem. | ||
| Description This attribute links a problem to a specific component or service within the IT infrastructure, such as 'Email Service' or 'Customer Relationship Management Platform'. It provides critical business context to the technical issue. In process mining analysis, the Affected Service allows for a business-centric view of the process. It helps answer questions like, 'Which services generate the most problems?' or 'What is our average resolution time for problems affecting critical financial systems?'. This context is crucial for prioritizing improvement efforts based on business impact. Why it matters Provides business context by linking technical problems to the services they impact, enabling prioritization based on business criticality. Where to get This is typically linked from a Configuration Management Database (CMDB) and stored in a 'Configuration Item' or 'Service' field on the problem record. Examples Email and Collaboration ServicesSAP ERP FinancialsCorporate VPNMain Customer Website | |||
| Priority Priority | The assigned priority level of the problem, which dictates the urgency of investigation and resolution. | ||
| Description Priority is a key attribute used to classify problems based on their business impact and urgency. It helps teams focus their efforts on the most critical issues first. Priority levels are often standardized, such as Critical, High, Medium, and Low. In process analysis, Priority is a powerful dimension for filtering and comparison. Analysts can compare the process flow for high-priority problems versus low-priority ones to see if they are handled differently or more efficiently. It is also fundamental for SLA compliance analysis, as SLAs are often tied to priority levels. Why it matters Allows for segmenting analysis to compare how critical problems are handled versus routine ones, and is essential for measuring SLA adherence. Where to get This is a standard field in the main problem record table of most ITSM platforms. Examples 1 - Critical2 - High3 - Medium4 - Low | |||
| Reassignment Count ReassignmentCount | The number of times the problem record was reassigned between different support groups or individuals. | ||
| Description This metric counts how many times the responsibility for a problem was transferred. A high reassignment count often indicates process inefficiency, such as incorrect initial routing or a lack of clarity in team responsibilities. In process mining, this is a key indicator of process friction. It can be used to identify 'ping-pong' scenarios where a problem bounces back and forth between teams. Analyzing cases with high reassignment counts can reveal knowledge gaps or process flaws that lead to significant delays and wasted effort. Why it matters Helps quantify process inefficiency by tracking excessive handoffs, which often point to incorrect routing, knowledge gaps, or unclear responsibilities. Where to get This is often a counter field that is incremented on the problem record with each assignment change. It can also be calculated from the event log. Examples 0135 | |||
| Related Incident Count RelatedIncidentCount | The total number of individual incident records linked to the problem. | ||
| Description This attribute quantifies the impact of a problem by showing how many user-facing incidents it has caused. A problem with a high number of related incidents is typically more disruptive to the business. This metric is a powerful tool for prioritization and impact analysis. In process mining, it can be used to correlate the number of incidents with investigation time or resolution priority. It helps organizations understand the scale of issues and justifies the resources spent on problem management by showing how many incidents are prevented by a single fix. Why it matters Quantifies the business impact of a problem, helping to prioritize investigations and measure the effectiveness of the resolution. Where to get This value is often a calculated field on the problem record that counts the number of linked incident records. Examples 5281501 | |||
| Root Cause Category RootCauseCategory | The final classification of the underlying cause that led to the problem. | ||
| Description Once an investigation is complete, the Root Cause Category is used to classify the fundamental reason for the problem, such as 'Software Defect', 'Hardware Failure', or 'Configuration Error'. This categorization is vital for strategic improvement. This attribute is the cornerstone of the 'Root Cause Investigation Performance' dashboard. By analyzing the frequency of different root cause categories, organizations can identify recurring systemic issues and prioritize long-term fixes. It helps shift the focus from reactive problem solving to proactive prevention. Why it matters This is critical for strategic analysis, helping to identify systemic issues and trends in what is causing problems across the organization. Where to get This information is usually captured in a dedicated field on the problem record, often filled in before or during the closure phase. Examples Configuration ErrorSoftware DefectHardware FailureUser Training Issue | |||
| SLA Breached SlaBreached | A flag indicating whether the problem resolution exceeded its assigned SLA due date. | ||
| Description This boolean attribute provides a simple, direct indicator of whether a Service Level Agreement was met. It is typically set to true if the problem's resolution timestamp is later than its SLA Due Date. As a direct outcome measure, this flag is extremely useful for high-level dashboarding and reporting. In process mining, it can be used to create conformance checks or to filter for all breached cases. Analyzing the process maps of breached versus non-breached problems can reveal patterns, bottlenecks, or specific activities that are common causes of SLA failure. Why it matters Provides a clear success or failure outcome for SLA compliance, making it easy to filter for and analyze the process paths that lead to breaches. Where to get This is often a derived or calculated field, determined by comparing the resolution timestamp to the SLA Due Date. Examples truefalse | |||
| SLA Due Date SlaDueDate | The target date and time by which the problem record is expected to be resolved according to the service level agreement. | ||
| Description The SLA Due Date sets a formal target for problem resolution. This target is usually determined based on the problem's priority and the terms defined in the service level agreement (SLA). This attribute is essential for the 'SLA Compliance Overview' dashboard. By comparing the actual resolution time with the SLA Due Date, organizations can calculate SLA success rates. Process mining can further break this down to identify which process steps or teams are contributing most to SLA breaches. Why it matters Defines the resolution target, forming the basis for all SLA compliance measurement and reporting. Where to get This date is typically calculated and stored on the problem record based on its creation time and priority. Examples 2023-05-20T17:00:00Z2024-01-10T09:30:00Z2024-03-01T12:00:00Z | |||
| Support Group SupportGroup | The technical team or department responsible for investigating and resolving the problem at a given time. | ||
| Description The Support Group indicates which team is assigned to the problem. As a problem progresses, it may be reassigned between different groups, such as from a Level 2 support team to a specialized Network Engineering team. This attribute is essential for analyzing team performance and inter-team handoffs. Process mining can highlight delays caused by reassignments, measure how long problems stay with each group, and identify which teams are most effective at resolving certain types of problems. It directly supports dashboards like 'Support Group Handoff Analysis'. Why it matters Crucial for analyzing team performance, identifying bottlenecks caused by handoffs, and understanding workload distribution across different teams. Where to get This information is typically stored in the problem record's assignment history or main details table within the ITSM system. Examples Network OperationsDatabase AdministrationApplication Support L3Security Team | |||
| Assigned User AssignedUser | The individual user or coordinator currently assigned to manage the problem record. | ||
| Description This attribute identifies the specific person responsible for the problem at any point in time. While the Support Group defines the team, the Assigned User points to the individual agent, engineer, or coordinator handling the investigation. Analyzing by Assigned User can help in understanding individual workloads, performance, and training needs. It can highlight if certain individuals are becoming bottlenecks or if work is not being distributed evenly within a team. This view is complementary to the support group analysis. Why it matters Enables analysis of individual workload and performance, helping to identify top performers or individuals who may require additional support or training. Where to get This field is typically found in the main problem record table, often labeled as 'Assignee', 'Assigned To', or 'Coordinator'. Examples Alice JohnsonajohnsonBob Smithbsmith | |||
| Problem Status ProblemStatus | The current lifecycle state of the problem record, such as Open, Under Investigation, or Closed. | ||
| Description The Problem Status indicates the current stage of the problem in its workflow. It provides a snapshot of where the problem is at any given time, from initial logging to final resolution. While the Activity Name captures the event of changing status, the Problem Status itself is useful for analyzing the current backlog. It allows for creating dashboards that show the number of open problems in each state, helping to manage workloads and identify records that are stuck in a particular phase for too long. Why it matters Indicates the current stage of a problem, which is essential for backlog analysis and identifying problems stalled in a specific phase. Where to get This is a standard field on the main problem record table that is updated as the problem moves through its lifecycle. Examples OpenRoot Cause AnalysisAwaiting ChangeResolvedClosed | |||
| Related Change Request ID RelatedChangeRequestId | The identifier of the change request initiated to implement the permanent fix for the problem. | ||
| Description This attribute creates a direct link between the problem management process and the change management process. It is used when a code change, hardware replacement, or other modification is required to resolve the problem's root cause. Analyzing this link is key to understanding the 'Change Management Handoff Delay'. Process mining can measure the time from when a root cause is identified to when a change request is created, and from when the change is implemented to when the problem is finally closed. This helps identify inefficiencies in the interaction between the two processes. Why it matters Links the problem to its solution in change management, enabling analysis of handoff delays and the end-to-end resolution lifecycle. Where to get This is typically a reference field on the problem record that links to the corresponding record in the change management system or module. Examples CHG0030219CR-8812CHANGE-401 | |||
| Workaround Provided WorkaroundProvided | A flag indicating whether a temporary workaround has been identified and communicated for the problem. | ||
| Description This attribute tracks whether a temporary solution has been made available to mitigate the impact of the problem while a permanent fix is being developed. This is a key milestone in the problem management lifecycle. This is a critical attribute for the 'Workaround Effectiveness And Speed' dashboard. Process mining can be used to calculate the average time to provide a workaround, and subsequent analysis can correlate the provision of a workaround with a reduction in new related incidents. This helps measure the team's ability to quickly restore service, even before the root cause is fixed. Why it matters Indicates if service has been temporarily restored, allowing for analysis of how quickly the team can mitigate business impact. Where to get This can be a boolean flag ('WorkaroundPublished'), or derived from the presence of text in a workaround details field. Examples truefalse | |||
Problem Management Activities
| Activity | Description | ||
|---|---|---|---|
| Change Request Initiated | This event captures the creation or linking of a formal change request to the problem record. It signifies the handoff from the problem management process to the change management process for implementing a permanent fix. | ||
| Why it matters This activity is critical for analyzing the delay between problem diagnosis and the initiation of a fix. It helps identify bottlenecks at the intersection of problem and change management. Where to get This is typically an explicit event found in the record's relationship or link history, showing an association to a change record. Capture Identify the event where a change record is linked to the problem record. Event type explicit | |||
| Investigation Started | This event marks the transition of the problem record from a new or pending state to an active investigation state. It indicates that an analyst has formally begun working on diagnosing the issue. | ||
| Why it matters This activity helps measure the initial response time and backlog processing speed. The duration between creation and investigation start is a key indicator of team responsiveness. Where to get This is often inferred from a status change in the record's history, such as moving from 'New' to 'In Progress' or 'Under Investigation'. Capture Capture the timestamp when the status first changes to an active investigation state. Event type inferred | |||
| Permanent Fix Implemented | This event indicates that the permanent technical solution, often managed through a change request, has been successfully deployed. It marks the completion of the remediation work. | ||
| Why it matters This activity concludes the solution implementation phase. The time from change initiation to this point measures the efficiency of the change management process in resolving problems. Where to get This is typically inferred from the problem record's status moving to 'Resolved' or 'Solution Implemented', often triggered by the closure of the linked change request. Capture Infer from a problem status change to 'Resolved', or from the completion timestamp of the associated change record. Event type inferred | |||
| Problem Record Closed | This is the final activity in the lifecycle, signifying that the problem record is administratively closed and no further action is expected. The case is considered complete and archived. | ||
| Why it matters This activity is the primary end point for most process instances. It is essential for calculating the total end-to-end duration of the problem management process. Where to get This is almost always an explicit event captured from a status change to 'Closed' in the record's history log. Capture Use the timestamp when the record's status is set to 'Closed'. Event type explicit | |||
| Problem Record Created | This is the initial creation of a problem record. It signifies the formal start of the problem management process and establishes the baseline timestamp for all subsequent analysis. | ||
| Why it matters This activity is the primary start point for every process instance. Analyzing the time from this event to others is crucial for understanding overall process duration and front-end delays. Where to get This is typically captured from the creation timestamp of the primary problem record or ticket table. It is almost always an explicit field in the source data. Capture Use the 'Created On' or similar timestamp from the main problem table. Event type explicit | |||
| Root Cause Identified | This activity marks the milestone where the underlying cause of the problem has been successfully diagnosed and documented. It represents the completion of the investigation phase. | ||
| Why it matters This is a crucial milestone for measuring diagnostic efficiency. The duration from investigation start to root cause identification is a key performance indicator for problem analysis. Where to get This is often inferred from a status change to 'Root Cause Identified' or captured when a 'Root Cause' field is first populated with information. Capture Capture the timestamp of a status change or the first update to a 'Root Cause' text field. Event type inferred | |||
| Workaround Provided | This event signifies that a temporary solution or workaround has been documented and made available. This action helps to mitigate the impact on end-users while a permanent fix is developed. | ||
| Why it matters The time to provide a workaround is a critical KPI for measuring the team's ability to restore service quickly. This activity helps analyze the speed and effectiveness of temporary solutions. Where to get This can be captured by the first timestamp a 'Workaround' text field is populated, a 'Communicate Workaround' action is logged, or a specific 'Workaround Available' flag is set. Capture Detect the first population of a workaround field or a related publication event. Event type explicit | |||
| Awaiting Change Implementation | This activity represents a state where the problem record is on hold, pending the completion of an associated change request. The problem team is waiting for the change team to deploy the fix. | ||
| Why it matters Isolating this waiting period helps to accurately measure the time spent within the change management process versus the problem management process, improving accountability. Where to get This is usually inferred from a status change to a 'Pending Change' or 'Fix in Progress' state in the problem record's history. Capture Capture the timestamp when the problem record's status changes to reflect it is waiting on a change. Event type inferred | |||
| Post-Implementation Review Done | This event marks the completion of a post-implementation review (PIR). This formal review process analyzes the handling of the problem to identify lessons learned and process improvements. | ||
| Why it matters Tracking PIR completion is important for process compliance and continuous improvement. It ensures that valuable insights from major problems are captured and acted upon. Where to get This is often captured by the completion of a PIR sub-task, a status change to 'Review Complete', or the population of a PIR completion date field. Capture Identify the completion of a PIR-related task or a specific status update. Event type explicit | |||
| Priority Changed | This activity captures any update to the priority, impact, or urgency of the problem record after its initial creation. It reflects a re-evaluation of the problem's business importance. | ||
| Why it matters Analyzing priority changes helps identify problems that are frequently escalated or de-escalated, which can impact resource allocation and SLA compliance. Where to get This is typically recorded in an audit log or change history table that tracks modifications to the 'Priority' field. Capture Track all updates to the 'Priority' field in the record's change history. Event type explicit | |||
| Problem Record Cancelled | This activity represents the termination of a problem record before a resolution was reached. This may happen if the record was created in error, is a duplicate, or is no longer relevant. | ||
| Why it matters Analyzing cancellations helps understand the quality of incoming problem records. A high cancellation rate may suggest a need for better training or qualification criteria. Where to get This is captured from a status change to 'Cancelled', 'Rejected', or 'Withdrawn' in the record's history. Capture Identify the timestamp when the status changes to a terminal cancelled state. Event type explicit | |||
| Problem Record Reopened | This activity occurs when a previously resolved or closed problem record is returned to an active state. It usually indicates that the implemented fix was unsuccessful or the problem has recurred. | ||
| Why it matters A high reopen rate is a key indicator of poor resolution quality. Tracking this activity is critical for measuring first-time fix rates and identifying ineffective solutions. Where to get This event is captured by monitoring the record's status history for a transition from a closed or resolved state back to an open or in-progress state. Capture Identify status changes from 'Resolved' or 'Closed' back to an active state like 'Open'. Event type explicit | |||
| Resolution Verified | This activity represents the confirmation that the implemented fix has effectively solved the underlying problem and that normal service has been restored. It is the final validation step before closure. | ||
| Why it matters This step provides a quality check on the resolution. Analyzing the time taken for verification can highlight delays in confirming the success of a fix. Where to get This can be an explicit status like 'Verification' or inferred from the transition to a 'Resolved' or 'Solved' state. Capture Capture the timestamp when the status changes to a state indicating the fix has been confirmed. Event type inferred | |||
| SLA Breach Detected | This event signifies that the time taken to reach a resolution or response milestone has exceeded the predefined Service Level Agreement (SLA) target. It is a system-generated or calculated event. | ||
| Why it matters Tracking SLA breaches is fundamental for performance management and compliance reporting. It directly highlights cases that failed to meet service level commitments. Where to get This can be a specific flag or event logged by the system, or it can be calculated by comparing the resolution timestamp against the SLA due date. Capture Calculate by comparing resolution or response timestamps to SLA target timestamps, or capture a system-generated breach event. Event type calculated | |||
| Support Group Assigned | This activity represents the assignment or reassignment of the problem record to a specific support group or team. It captures the transfer of ownership and responsibility for the investigation. | ||
| Why it matters Tracking assignments is essential for analyzing handoff delays, identifying bottlenecks between teams, and understanding group performance. High reassignment counts often indicate process inefficiency. Where to get This information is usually found in an audit log or history table that tracks changes to the 'Assignment Group' or 'Support Team' field on the problem record. Capture Identify all changes to the assignment group field in the record's history log. Event type explicit | |||
Extraction Guides
Extraction methods vary by system. For detailed instructions,