Is there a way to report on audits in a way that is efficient (or a way to report on user actions in regards to incidents)?

bcronrath
Kilo Guru

My goal is to be able to come up with an incident report for each user where I can see incidents that they have modified in the last 48 hours.   Problem is with the current incident fields this doesn't seem possible.   You can search on an updated last 48 hours filter, however the updated by will always be the latest user to update an incident so if a different user touched the incident before that there doesn't seem to be a way to accomplish this in an incident report.   I was thinking of doing a report on the audit table, or even just running a script that pulls the data, but trying to query sys_audit in any fashion seems to be a horrible idea and I have to cancel the transaction before it just endlessly runs.

Does anyone know of a way to grab the data I am looking for here?   Is sys_audit my only option?


Best regards,

Brian

1 ACCEPTED SOLUTION

Michael Fry1
Kilo Patron

Definitely reporting on sys_audit is almost impossible, but you can use Metrics to get your answers. There is a little setup involved, but it works nice.



Step 1: create new Metric, on Incident table, with Type Script Calculation but leave Script area blank. Field doesn't matter but note sys_id of new Metric.


metric.jpg



Step 2: create a before business rule on Incident table like below


br.jpg



Step 3: add the following script in the advanced section of your BR. Update the 2 sys_ids of var MetricSysID to match your Metric from Step 1


{


      //sys id of the metric definition


      var metricSysID = '3c9eb5770f4a9600c2498f8ce1050ea5';


      var mi= new GlideRecord('metric_instance');


      mi.addQuery('id',current.sys_id);


      mi.addQuery('definition',metricSysID);


      mi.query();


      //if mi.next will insert another if exists.


      //if !mi.next, will insert new entry


      if(!mi.next()){


              insertMetrics();


      }


      // since !mi.next inserts new, this will insert updates.


      else if(current.active == true && current.operation() == 'update'){


              insertMetrics();


      }


}


function insertMetrics() {


      var mi= new GlideRecord('metric_instance');


      //sys id of the metric definition


      var metricSysID = '3c9eb5770f4a9600c2498f8ce1050ea5';


      mi.initialize();


      mi.definition = metricSysID;


      mi.start = previous.sys_updated_on;


      mi.end = gs.nowDateTime();


      mi.duration = gs.dateDiff(mi.start, mi.end);


      mi.id = current.sys_id;


      mi.value = gs.getUser().name;


      mi.calculation_complete = true;


      mi.insert();


}


gs.log('Metric trigger');



Step 4: (last one) Build a report of the newly captured data. (Doesn't not work on existing data, just new data after this is implemented


report.jpg



It might seem like a lot but screen shots are better than a bunch of words!


I use this all the time.


View solution in original post

61 REPLIES 61

Now i will try this way. Still do not understand one issue. if i perform this in report it also should show in reporting


I tried the same way. But it did not worked for me. What it will show as a result?one more question from my side. I will describe scenario. How i can learn how many tickets was assigned to my group for last 2 year?Then how many of them was reassigned to another groups. For example my group can be assigned to 3 tickets during month. But one of them will not be closed by our group. It will be reassigned to another group. In my report i want to view this action. I was assigned 3 ticket.2 ticket was closed by our team. and one of them was assigned to another group?


Out of the box there is a Metric named Assignment Group. It keeps track of all assignment groups through the life of an incident. You can slice that data to get what you want by reporting on the incident_metric table with definition is assignment group, and value is your group, and calculation is true. If calculation is true, and created is the same as the Incident, and value is your group - then the incident was assigned and closed by your group.


I arranged it like that. did not work



qqqq.PNG


Hello,


I If in first step i want to create another metric definition for example "resolved", how i could manage it in third step - in scripting?