is_sla_breached

Use the `is_sla_breached()` function to return a boolean value indicating whether an SLA has breached its goal. The function wraps the same time-tracking logic used by [`sla_time_remaining`](sla_time_remaining)—accounting for active, paused, and completed SLAs and time spent paused—so that you can quickly filter and flag cases that are out of SLA.

## Syntax

```sql
is_sla_breached (<sla_timer_field>)
```

## Parameters

| Name | Type | Required | Description |
| ----------------- | ---- | -------- | ------------------------------------------------------------------------------------------------------------------- |
| `sla_timer_field` | JSON | Yes | An SLA field exposed in the `cases` dataset, such as `resolution_sla`, or a user-defined SLA under `custom_fields`. |

## Returns

The `is_sla_breached()` function returns a boolean:

* **True** when the SLA has exceeded its goal—that is, when the equivalent `sla_time_remaining()` value is negative.
* **False** when the SLA is still within its goal.
* **NULL** when the SLA has no active or completed timing information.

## Usage notes

* Time spent paused does not count toward a breach, so a case that is paused does not continue to lose remaining time.
* The function can be used in the `filter` , `sort`, and `comp` stages. It is especially useful for quick filtering, for example `filter is_sla_breached(resolution_sla) = true`.
* Use `is_sla_breached()` when you only need a yes/no breach flag; use [`sla_time_remaining` ](sla_time_remaining)when you need the numeric duration for ranking or aggregation.
* The function is available to XQL widgets in dashboards and reports, and can be executed through PAPI (for example, `POST /public_api/v1/xql/get_query_results/`).

## Examples

### Example 1: Flag breached cases

**Goal**: Add a boolean column that indicates whether each case has breached its resolution SLA.

**XQL code**:

```sql
dataset = cases // Query the cases dataset
| alter breached = is_sla_breached(resolution_sla) // true if past SLA goal
| fields case_id, status, resolution_sla, breached
| limit 5
```

**Explanation**: For each case, `is_sla_breached()` computes the net elapsed time and compares it against the SLA goal. Cases whose elapsed time (minus pauses) exceeds the goal return **true**; all others return **false**.

**Output**:

| CASE\_ID | STATUS | RESOLUTION\_SLA | BREACHED |
| -------- | ------------ | ----------------------------------------------- | -------- |
| 23339 | in\_progress | {"goal":"02:00:00","status":"within\_sla", ...} | false |
| 23340 | in\_progress | {"goal":"01:00:00","status":"within\_sla", ...} | false |
| 23341 | in\_progress | {"goal":"01:00:00","status":"breached", ...} | true |
| 23342 | resolved | {"goal":"02:00:00","status":"within\_sla", ...} | false |
| 23343 | resolved | {"goal":"01:00:00","status":"breached", ...} | true |

### Example 2: Filter to only breached cases

**Goal**: Return only the cases that have breached their resolution SLA.

**XQL code**:

```sql
dataset = cases
| filter is_sla_breached(resolution_sla) = true // Keep only breached cases
| fields case_id, severity, assignee
| sort desc severity
```

**Explanation**: The `filter` stage keeps only rows where `is_sla_breached()` evaluates to **true**, producing a focused list of cases that are out of SLA and need escalation.

**Output**:

| CASE\_ID | SEVERITY | ASSIGNEE |
| -------- | -------- | -------- |
| 23341 | critical | alice |
| 23360 | high | bob |
| 23343 | medium | carol |

### Example 3: Count breaches by severity

**Goal**: Summarize how many cases have breached their SLA, grouped by severity, to measure operational performance.

**XQL code**:

```sql
dataset = cases
| alter breached = is_sla_breached(resolution_sla)
| filter breached = true
| comp count(case_id) as breached_count by severity
| sort desc breached_count
```

**Explanation**: After flagging each case, the query filters to breached cases and aggregates the count per severity. Because `is_sla_breached()` output flows into standard `filter` and `comp` stages, it integrates cleanly with statistical reporting.

**Output**:

| SEVERITY | BREACHED\_COUNT |
| -------- | --------------- |
| high | 12 |
| critical | 8 |
| medium | 5 |
| low | 1 |

### Example 4: Combine breach status with a custom SLA

**Goal**: Evaluate breach status against a user-defined SLA stored under `custom_fields`, alongside the standard resolution SLA.

**XQL code**:

```sql
dataset = cases
| alter resolution_breached = is_sla_breached(resolution_sla),
 triage_breached = is_sla_breached(custom_fields -> triage_sla)
| filter resolution_breached = true or triage_breached = true
| fields case_id, resolution_breached, triage_breached
| limit 5
```

**Explanation**: Because custom SLAs use the same JSON structure as the resolution SLA, `is_sla_breached()` works identically on them. The query flags cases that have breached either the resolution SLA or the custom triage SLA.

**Output**:

| CASE\_ID | RESOLUTION\_BREACHED | TRIAGE\_BREACHED |
| -------- | -------------------- | ---------------- |
| 23341 | true | true |
| 23360 | true | false |
| 23372 | false | true |
| 23380 | true | false |

## Related articles

* **Functions**: [`sla_time_remaining`](sla_time_remaining)
* **Stages**: [`alter`](file:///0960011/Cortex_XQL_Command_Reference/Stages/alter.md), [`filter`](file:///0960011/Cortex_XQL_Command_Reference/Stages/filter.md), [`sort`](file:///0960011/Cortex_XQL_Command_Reference/Stages/sort.md), [`comp`](file:///0960011/Cortex_XQL_Command_Reference/Stages/comp.md), [`config`](file:///0960011/Cortex_XQL_Command_Reference/Stages/config.md)