Why the investigation phase is the bottleneck
Support ticket lifecycle is typically modeled as: receive → triage → assign → resolve → close. But "resolve" hides the most expensive step. For technical B2B tickets, resolution decomposes into two distinct phases:
- •Investigation (20–45 minutes): Querying systems, correlating data, identifying root cause
- •Response (5 minutes): Writing the customer reply once you know the answer
Support platforms optimize triage and assignment. Chatbots handle the 20% of tickets that are FAQ-answerable. AI copilots help draft the 5-minute response faster. But nobody automates the 20–45 minute investigation — the part where an engineer manually queries 4–6 systems and correlates the results.
This is why resolution time benchmarks plateau. You can route tickets instantly, deflect the simple ones, and draft responses with AI — but if the investigation still takes 30 minutes, resolution time stays at 35 minutes.
The 4-query investigation method
After studying hundreds of B2B support investigations at companies using ClickHouse, Linear, Stripe, and GitHub, a consistent pattern emerges. Most technical investigations follow 4 queries in sequence:
- Symptom query — What is actually happening? Pull the customer's specific data from your observability system (ClickHouse, Datadog, etc.). Don't rely on their description — measure it. Example: "429 error rate for customer acme-corp spiked from 12% to 43% over the last 2 hours."
- Correlation query — Is this a known issue? Search your bug tracker (Linear, Jira) for matching symptoms. Check your status page for ongoing incidents. Example: "LIN-482: rate limit regression — open, priority urgent."
- Elimination query — What isn't causing it? Check billing (Stripe) for payment issues, plan limits, or feature access changes. Check deployment history (GitHub) for recent changes. Example: "Plan active, usage within limits. Last deploy: 6 days ago, unrelated endpoint."
- Synthesis — Combine findings into a diagnosis with confidence level and recommended action. Example: "Known bug LIN-482 causing elevated 429s. Fix in PR #891, shipping in 3 days. Workaround: exponential backoff."
Why this method takes 20–45 minutes manually
Each query requires context-switching to a different tool, writing or adjusting a search query, interpreting results, and mentally holding findings from previous queries. The total time breaks down approximately:
| Step | Tool | Time | What makes it slow |
|---|---|---|---|
| Symptom query | ClickHouse / Datadog | 5–15 min | Writing SQL, finding the right table, narrowing the time window |
| Correlation query | Linear / Jira + StatusPage | 5–10 min | Searching with the right keywords, reading through matches |
| Elimination query | Stripe + GitHub | 5–10 min | Navigating to the right customer, checking multiple fields |
| Synthesis | Your brain | 5–10 min | Correlating findings, assessing confidence, drafting response |
The biggest cost isn't any single query — it's the context-switching. An engineer averages 5–10 tab switches per investigation, each requiring them to mentally reload where they are in the investigation and what they've found so far.
What automated investigation looks like
The 4-query method can be automated when three conditions are met: the systems have APIs, the query patterns are repeatable, and the investigation logic can be encoded into playbooks. When automated, the same investigation that takes a human 20–45 minutes completes in under 2 minutes.
At Portkey, an AI gateway handling billions of API requests, this automation reduced median investigation time from 20–45 minutes to 2 minutes across 200+ tickets — with zero changes to their existing support platform or team workflows.
"The investigation pattern was the same 80% of the time. Check ClickHouse, check Linear, check Stripe, synthesize. We just couldn't justify the engineering time to automate it ourselves."
How to evaluate your investigation workflow
Start by timing 10 consecutive technical support tickets. For each, track:
- •How many systems did the engineer query?
- •How long did the investigation take (before they started writing the response)?
- •Could the investigation have been done with read-only API access to those systems?
- •How many times was the same investigation pattern repeated across different tickets?
The 80% rule
If 80% or more of your investigations follow 3 or fewer patterns, and the data sources have APIs, the investigation is automatable. The question is whether to build it yourself or use a purpose-built tool.