You may have to join multiple tables to find this information. Like you know how to query incident table for keyword on Short description and description you can do the same on fields in tables. Variables are stored in table: "sc_item_option_mtom". Attachments probably in sys_attachment or more. But i don't think this is the will be a reliable solution since the user or application name can appear in etc... how many different areas would you search. I think this is more of a governance and process issue, you need to redesign how people are requesting access to applications.