insights-clustering

洞察聚类与分析

概述

此技能涵盖对 ServiceNow 运营数据中的洞察进行聚类和分析，以识别模式并生成可执行的建议：

• 按主题相似性对事件、案例和对话进行分组，以发现反复出现的主题
• 对各类交互进行情感分析，以识别服务质量趋势
• 分析解决模式，以发现最佳实践和知识差距
• 在新兴问题集群发展为重大问题之前将其检测出来
• 生成包含数据支持的建议的观点（POV）摘要
• 构建将运营模式与业务影响关联起来的趋势报告

适用场景： 执行定期服务评审分析、调查支持量激增、准备以数据为依据的改进建议、识别主动问题管理候选项，或从运营数据中生成管理洞察时。

前提条件

• 角色： admin、analytics_admin、itil 或 problem_manager
• 插件： 建议安装 com.glide.interaction（Agent Workspace）、com.snc.problem_management（Problem Management）
• 访问权限： 对 incident、sn_customerservice_case、interaction、sys_cs_conversation、kb_knowledge、problem 表具有读取权限
• 数据： 至少 30 天的事件、案例或交互数据，才能进行有意义的聚类
• 相关技能： 用于交互挖掘的 genai/agent-miner，用于识别知识库差距的 knowledge/gap-analysis

流程

第 1 步：定义分析范围

确定用于聚类的数据源、时间范围和重点领域。

ANALYSIS SCOPE DEFINITION:

Data Sources:
- [ ] Incidents (incident table)
- [ ] Customer Cases (sn_customerservice_case)
- [ ] Agent Interactions (interaction)
- [ ] Virtual Agent Conversations (sys_cs_conversation)
- [ ] Problem Records (problem)

Time Range: [start_date] to [end_date]
Focus Area: [All / Specific category / Assignment group / Service]
Minimum Cluster Size: [threshold, e.g., 5 records]

ANALYSIS OBJECTIVES:
1. [Primary objective, e.g., "Identify top incident drivers"]
2. [Secondary objective, e.g., "Find knowledge gaps"]
3. [Tertiary objective, e.g., "Assess customer sentiment trends"]

第 2 步：提取用于聚类的事件数据

提取包含文本和分类字段的事件记录。

MCP 方法：

Tool: SN-Query-Table
Parameters:
  table_name: incident
  query: sys_created_on>=javascript:gs.daysAgo(30)^state!=8^ORDERBYDESCsys_created_on
  fields: sys_id,number,short_description,description,category,subcategory,priority,impact,urgency,state,close_code,close_notes,assignment_group,cmdb_ci,business_service,resolved_at,opened_at,resolution_code
  limit: 1000

REST 方法：

GET /api/now/table/incident
  ?sysparm_query=sys_created_on>=javascript:gs.daysAgo(30)^state!=8
  &sysparm_fields=sys_id,number,short_description,description,category,subcategory,priority,impact,urgency,state,close_code,close_notes,assignment_group,cmdb_ci,business_service,resolved_at,opened_at
  &sysparm_limit=1000
  &sysparm_display_value=true

第 3 步：提取案例和交互数据

提取其他数据源，用于跨渠道分析。

MCP 方法：

Tool: SN-Query-Table
Parameters:
  table_name: sn_customerservice_case
  query: sys_created_on>=javascript:gs.daysAgo(30)^ORDERBYDESCsys_created_on
  fields: sys_id,number,short_description,description,category,subcategory,priority,state,resolution_code,close_notes,contact,account,product
  limit: 500

Tool: SN-Query-Table
Parameters:
  table_name: interaction
  query: sys_created_on>=javascript:gs.daysAgo(30)^state=closed
  fields: sys_id,number,short_description,channel,category,close_code,assignment_group,duration
  limit: 500

第 4 步：执行主题聚类

使用短描述和描述的文本分析，按主题相似性对记录进行分组。

聚类方法：

1. 按类别分组： 按现有类别／子类别分类体系分组
2. 文本相似度： 按关键词和短语重叠情况对 short_description 字段进行聚类
3. 按 CI 分组： 按受影响的配置项或业务服务分组
4. 按解决方案分组： 按 close_code 和解决模式分组

MCP 方法（类别聚合）：

Tool: SN-Query-Table
Parameters:
  table_name: incident
  query: sys_created_on>=javascript:gs.daysAgo(30)
  fields: category,subcategory
  limit: 2000

主题集群输出：

=== TOPIC CLUSTERS ===
Analysis Period: [date range]
Total Records Analyzed: [count]
Clusters Identified: [count]

CLUSTER 1: [Topic Name] - [count] records ([%] of total)
  Keywords: [top keywords]
  Categories: [categories represented]
  Sample Records:
  - [INC#]: [short_description]
  - [INC#]: [short_description]
  Trend: [increasing/stable/decreasing] vs prior period

CLUSTER 2: [Topic Name] - [count] records ([%] of total)
  ...

第 5 步：分析情感模式

根据客户评论和交互记录评估情感。

MCP 方法：

Tool: SN-Query-Table
Parameters:
  table_name: sys_journal_field
  query: element_id=[RECORD_SYS_ID]^element=comments
  fields: value,sys_created_on,sys_created_by
  limit: 20

情感分类框架：

信号	正面	中性	负面
用语	“谢谢”、“很好”、“已解决”	“好的”、“明白”、“客观陈述”	“沮丧”、“无法接受”、“问题仍未解决”
频率	单次联系	问题解决后的跟进	多次升级
重新打开次数	无	重新打开 1 次	重新打开 2 次或以上
调查评分	4-5	3	1-2

情感分布：

SENTIMENT ANALYSIS:
Positive: [count] ([%])
Neutral: [count] ([%])
Negative: [count] ([%])

NEGATIVE SENTIMENT DRIVERS:
1. [Topic/Category]: [count] negative interactions
   Common complaints: [themes]
2. [Topic/Category]: [count] negative interactions
   Common complaints: [themes]

SENTIMENT TREND (vs Prior Period):
Positive: [+/- change]
Negative: [+/- change]

第 6 步：分析解决模式

识别常见的解决方法及其成效。

MCP 方法：

Tool: SN-Query-Table
Parameters:
  table_name: incident
  query: sys_created_on>=javascript:gs.daysAgo(30)^state=6
  fields: category,subcategory,close_code,resolution_code,close_notes
  limit: 500

解决模式分析：

RESOLUTION PATTERNS:

CLUSTER: [Topic Name]
Total Incidents: [count]
Resolution Methods:
  1. [Resolution type] - [count] ([%]) - Avg Resolution Time: [time]
  2. [Resolution type] - [count] ([%]) - Avg Resolution Time: [time]
  3. [Resolution type] - [count] ([%]) - Avg Resolution Time: [time]

MOST EFFECTIVE RESOLUTION:
[Resolution type] resolves [%] of incidents in this cluster with
an average resolution time of [time] and [%] reopen rate.

KNOWLEDGE GAP:
[Count] incidents in this cluster had no matching KB article.
[Count] incidents were resolved by workaround (no permanent fix).

第 7 步：检测新兴集群

识别可能预示新问题的新出现或增长中的问题模式。

MCP 方法：

Tool: SN-Query-Table
Parameters:
  table_name: incident
  query: sys_created_on>=javascript:gs.daysAgo(7)
  fields: short_description,category,subcategory,cmdb_ci,business_service,priority
  limit: 500

将近期数量与基线进行比较：

EMERGING CLUSTER DETECTION:

ALERT: [Cluster Name]
Current Volume (7 days): [count]
Baseline (avg 7-day): [count]
Increase: [%]
Affected CIs: [list]

PATTERN: [Description of the emerging pattern]
POTENTIAL IMPACT: [Assessment of what this could become]
RECOMMENDED ACTION: [Create problem record / Investigate / Monitor]

第 8 步：跨渠道关联分析

关联事件、案例和交互中的模式。

CROSS-CHANNEL CORRELATION:

Topic: [Cluster Name]
Incidents: [count] | Cases: [count] | Interactions: [count]
Total Volume: [sum]

CHANNEL DISTRIBUTION:
  Self-Service: [%]
  Phone: [%]
  Chat: [%]
  Email: [%]
  Walk-up: [%]

INSIGHT: [Description of cross-channel pattern, e.g., "Users first attempt
self-service, fail, then call. Knowledge article KB0012345 is outdated."]

第 9 步：生成 POV 摘要

创建包含数据支持的建议的可执行观点摘要。

=== INSIGHTS POV SUMMARY ===
Analysis Period: [date range]
Data Analyzed: [total records] across [channels]
Generated: [date]

EXECUTIVE SUMMARY:
[2-3 sentence summary of key findings and their business impact]

TOP INSIGHT CLUSTERS:

1. [CLUSTER NAME] - [Priority: HIGH/MEDIUM/LOW]
   Volume: [count] records ([%] of total, [trend] vs prior period)
   Impact: [business impact description]
   Sentiment: [predominant sentiment]
   Root Pattern: [underlying cause or pattern]

   RECOMMENDATION:
   [Specific, actionable recommendation with expected outcome]

   ESTIMATED IMPACT:
   - Reduction in volume: [%] if addressed
   - Time savings: [hours/month]
   - Satisfaction improvement: [projected]

2. [CLUSTER NAME] - [Priority: HIGH/MEDIUM/LOW]
   ...

CROSS-CUTTING THEMES:
- [Theme that spans multiple clusters]
- [Systemic issue identified across data sources]

KNOWLEDGE GAPS IDENTIFIED:
| Topic | Volume | Existing KB | Gap Description |
|-------|--------|-------------|-----------------|
| [topic] | [count] | [None/Outdated] | [What is needed] |

PROACTIVE PROBLEM CANDIDATES:
| Pattern | Volume | Trend | Suggested PRB |
|---------|--------|-------|---------------|
| [pattern] | [count] | [increasing] | [problem description] |

ACTION PLAN:
| # | Action | Owner | Priority | Timeline |
|---|--------|-------|----------|----------|
| 1 | [Action] | [Team] | High | [timeframe] |
| 2 | [Action] | [Team] | Medium | [timeframe] |
| 3 | [Action] | [Team] | Low | [timeframe] |

DATA QUALITY NOTES:
- [Any data quality issues that may affect analysis accuracy]
- [Assumptions made in the clustering process]

第 10 步：为主要集群创建问题记录

对于值得主动调查的集群，创建问题记录。

MCP 方法：

Tool: SN-Create-Record
Parameters:
  table_name: problem
  data:
    short_description: "Proactive: [Cluster description] - [count] related incidents"
    description: |
      CLUSTER ANALYSIS:
      This problem was created based on insights clustering analysis
      identifying [count] related incidents over [time period].

      PATTERN:
      [Description of the recurring pattern]

      SAMPLE INCIDENTS:
      - [INC#]: [short_description]
      - [INC#]: [short_description]
      - [INC#]: [short_description]

      IMPACT:
      [Business impact assessment]

      SUGGESTED INVESTIGATION:
      [Where to start the root cause investigation]
    category: [category]
    priority: [priority based on cluster analysis]
    assignment_group: [relevant team]

工具使用

工具	用途	使用时机
SN-Query-Table	提取事件、案例和交互数据	主要数据收集
SN-Get-Record	获取记录详情以进行深入分析	调查特定记录
SN-Natural-Language-Search	根据描述相似度查找相关记录	交叉比对模式
SN-Create-Record	根据聚类结果创建问题记录	根据洞察采取行动

最佳实践

1. 至少使用 30 天的数据，以获得稳定的聚类结果
2. 结合结构化和非结构化数据 —— 仅使用类别会遗漏细节；仅使用文本会缺少上下文
3. 设置最小聚类阈值 —— 忽略少于 5 条记录的聚类，以减少噪声
4. 与之前的时期进行比较 —— 趋势比绝对数值更重要
5. 请 SME 验证 —— 让领域专家审核聚类标签和建议
6. 排除噪声记录 —— 过滤掉测试工单、重复项和自动生成的记录
7. 按影响加权 —— 10 起 P1 事件比 50 起 P4 事件更重要
8. 跟踪聚类变化 —— 每月重新运行聚类，查看哪些模式在扩大或缩小
9. 关联业务成果 —— 将技术模式转化为业务影响表述
10. 根据发现采取行动 —— 只做聚类分析而不采取行动，不过是分析作秀

故障排除

问题	原因	解决方案
小型聚类过多	阈值过低或数据过于多样	提高最小聚类大小；限制分析范围
聚类范围过宽	文本粒度不足	包含 description 字段，而不只是 short_description；添加子类别
情绪分析不准确	面向客户的评论有限	聚焦交互记录；使用重新打开次数作为情绪代理指标
未发现新兴聚类	环境稳定或基线不足	延长基线周期；降低检测阈值
跨渠道数据不匹配	各表的字段和类别不同	聚类前规范化类别映射；使用基于文本的聚类
分析数据量过大	时间范围内记录过多	缩小时间范围，或筛选特定类别／群组

示例

示例 1：月度 IT 服务评审

场景： 为 IT 服务管理评审生成月度洞察。

INSIGHTS POV - IT Services - February 2026

TOP 3 CLUSTERS:
1. VPN Connectivity Issues (187 incidents, +45% vs Jan)
   Driver: Recent network configuration change
   Action: Roll back VPN split-tunnel config change

2. Password Lockouts (142 incidents, stable)
   Driver: MFA policy change confusing users
   Action: Update KB article; add VA topic for guided MFA setup

3. Printer Issues - Building C (68 incidents, NEW cluster)
   Driver: New printer fleet deployment incomplete
   Action: Complete printer driver deployment; update print server config

示例 2：客户服务趋势分析

场景： 分析客户案例趋势，为季度业务评审提供信息。

CUSTOMER INSIGHTS - Q1 2026

SENTIMENT TREND: Negative sentiment increased 12% QoQ
PRIMARY DRIVER: Order processing delays (cluster of 234 cases)

CLUSTER ANALYSIS:
- Order Delays: 234 cases (28%) - Negative sentiment 78%
- Billing Disputes: 156 cases (19%) - Negative sentiment 65%
- Product Questions: 312 cases (37%) - Neutral sentiment 80%
- Account Access: 89 cases (11%) - Mixed sentiment

RECOMMENDATION: Order processing system needs capacity upgrade.
Current processing time exceeds SLA in 32% of orders during peak hours.

示例 3：主动识别问题

场景： 检测新兴模式，以便主动管理问题。

EMERGING PATTERN DETECTED:

Application: SAP Finance Module
7-Day Volume: 23 incidents (baseline: 8/week)
Increase: 188%
Affected Users: Finance department, 3 locations

Pattern: "SAP report timeout" and "SAP slow response" keywords
appearing with increasing frequency since March 12.

Correlated Event: Database maintenance performed March 11.

RECOMMENDATION: Create problem record PRB0005678.
Investigate database performance post-maintenance.
Potential index rebuild needed.

相关技能

• genai/agent-miner - 挖掘 Agent 交互，寻找自动化机会
• knowledge/gap-analysis - 识别知识库覆盖缺口
• knowledge/gap-grouping - 按主题对知识缺口进行分组
• itsm/problem-analysis - 对已识别问题进行根因分析
• reporting/trend-analysis - 趋势分析和可视化
• csm/sentiment-analysis - 客户情绪分析