Find Duplicates, Aging Tickets and SLA Risk in the Queue

Tier: Core · Workflow area: Ticket handling & triage · ~30 minutes

This is queue intelligence with tools you already have: a ticket export, a small embeddings script for duplicate detection, and an LLM pass that ranks the day's queue by risk. No ML platform purchase required.

When to use

• Morning sweep on a 50+ open-ticket queuethe volume where human pattern-matching across tickets reliably fails.
• Suspected emerging incidentthree "Wi-Fi slow" tickets from one floor are not three tickets; catching the cluster an hour earlier changes the day.
• SLA-sensitive contractsanywhere a breach carries penalties or executive attention, ranked risk beats sorted-by-date.

When NOT to use

• Queues under ~20 open ticketsscroll it; your eyes are faster and see context no embedding captures.
• As the incident detector of recordthis sweep supplements monitoring; if ticket clustering is how you learn about outages, the real gap is in your alerting.
• Auto-closing "duplicates"similarity is a lead, not a verdict. Merging tickets is a human action after reading both, always.

The recipe

1. 1.

   Export the working set. Open tickets plus the last 7 days of closed ones (closed tickets are how you spot "this new ticket is yesterday's incident recurring"). From ServiceNow:

   Copy

   curl -s -u "$SN_USER:$SN_PASS" \
     "https://yourinstance.service-now.com/api/now/table/incident?sysparm_query=active=true^ORclosed_atRELATIVEGT@dayofweek@ago@7&sysparm_fields=number,short_description,description,priority,sys_created_on,assignment_group,sla_due&sysparm_limit=500" \
     | jq -r '.result' > queue.json
   

   Freshservice: GET /api/v2/tickets?filter=...&per_page=100 paged into the same shape. CSV export from the UI works identically.

2. 2.

   Run duplicate detection with local embeddings. A 20-line script, fully offline, no ticket data leaving the machine:

   Copy

   # pip install sentence-transformers pandas
   import pandas as pd
   from sentence_transformers import SentenceTransformer, util
   
   df = pd.read_json("queue.json")
   texts = (df.short_description.fillna("") + ". " + df.description.fillna("").str[:300]).tolist()
   
   model = SentenceTransformer("all-MiniLM-L6-v2")
   emb = model.encode(texts, normalize_embeddings=True)
   
   pairs = util.paraphrase_mining_embeddings(emb, top_k=5)
   for score, i, j in pairs:
       if score >= 0.80:
           print(f"{score:.2f}  {df.number[i]} <-> {df.number[j]}")
           print(f"      {df.short_description[i][:70]}")
           print(f"      {df.short_description[j][:70]}\n")
   

   Read the pairs, not just the scores: 0.85 between "VPN disconnects hourly" and "GlobalProtect drops every hour" is a duplicate; 0.85 between two different users' "laptop slow" tickets may be a cluster — or Monday.

3. 3.

   Spot the emerging incident. Three-plus mutually similar tickets created within a short window is the signature. Add a time filter to the pair output, or just eyeball creation times on the clusters the script prints. When you find one: open a parent incident, link the children, and tell the desk before the tenth duplicate arrives.

4. 4.

   Rank the queue by risk with an LLM pass. Feed the export (subjects, priority, age, SLA due, last-update timestamp — no full descriptions needed) to your assistant:

   Copy

   Here is my open ticket queue as CSV. Produce the morning risk list.
   
   Rank by a combination of:
   - SLA due within 8 business hours (highest weight)
   - No agent update in > 2 business days ("aging silently")
   - Priority P1/P2
   - Reopened tickets (a reopen aging again is a complaint in progress)
   
   Output: top 10 as a table — number | risk driver | recommended action today.
   Then one line: any pattern you notice across the queue as a whole.
   Do not invent tickets or fields not present in the data.
   
   CSV:
   [paste]
   

5. 5.

   Sanity-check the ranking against the source of truth. Spot-check three of the top ten in the ITSM tool: is the SLA clock really where the export said? Exports lag and business-hour SLA math is subtle — the tool's SLA widget is authoritative, the LLM ranking is a lens. A good verified output for the sweep looks like:

   Copy

   1. INC0048201 | SLA breach in 3h, P2, no update 26h | assign now — owner OOO
   2. INC0048166 | reopened, aging 4 days               | call user, not email
   3. CLUSTER (5 tickets, floor 3, created 08:12–08:44) | open parent incident
   Pattern: 40% of aging tickets sit with one assignment group — check staffing.
   

6. 6.

   Make it a rhythm. Same sweep, same time, every workday. The value compounds: yesterday's clusters and today's clusters connect, and the "pattern" line starts catching slow burns (a printer model failing across sites over weeks) that no single day reveals.

Make it yours

• API-less shopsa manual CSV export into the same script and prompt works; schedule 15 minutes rather than building integration you do not need yet.
• ServiceNow with Predictive Intelligenceuse built-in similarity for the duplicate half (agent-side "similar incidents") and keep the LLM risk-ranking pass, which no ITSM ships well out of the box.
• Hosted-LLM constraintsthe embeddings script is already local; for the ranking pass, subjects + metadata usually clear the "no sensitive data" bar where full descriptions would not. If even subjects are sensitive, run the ranking on a local model too — the prompt is identical.

Quality check

• Every merge is human-readyou read both tickets before linking; similarity scores misfire on shared boilerplate ("Sent from my iPhone", signature blocks). Strip signatures in step 1 if your exports include them.
• Validate the SLA math weeklycompare the sweep's "due today" list against the ITSM SLA report once a week; if they diverge, fix the export query before trusting another ranking.
• Track catchescount incidents caught at three tickets instead of ten, and breaches avoided. This is the playbook whose value is easiest to show a manager; log it.
• Sandbox the script changesnew similarity threshold or model? Run old and new side-by-side on last week's export and diff the pairs before switching your morning sweep to it.