Hi.
I work with ServiceNow, a ticketing platform.
I wish to get only the current "new" incidents and display it in a dashboard, but when I put "| search status=New" I get results which turned "resolved" already.
Is there a way I can display only the current new incidents?
Can you please try this?
index=YOUR_INDEX OTHER_SEARCH_TERMS_IN_CASE
| dedup INCIDENT_FIELD_NAME
| rename comment as "dedup for fetching latest incident event"
| search status=New
| table YOUR_REQUIRED_FIELDS
In case you still face issues then please share some sample data with INCIDENT_FIELD_NAME and the status field.
I hope this will help you.
Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.
Can you please try this?
index=YOUR_INDEX OTHER_SEARCH_TERMS_IN_CASE
| dedup INCIDENT_FIELD_NAME
| rename comment as "dedup for fetching latest incident event"
| search status=New
| table YOUR_REQUIRED_FIELDS
In case you still face issues then please share some sample data with INCIDENT_FIELD_NAME and the status field.
I hope this will help you.
Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.