Incident Report Extract

[dassan]

When I am trying to create a report under data visualization for the incidents closed last month, I would like to extract the all the activity log details for each incident. 

As the activity formatter is not a field available, please suggest an alternate field which I can add under the columns in the report creation to get this data 

[KPNow]

Hi @dassan :

To extract activity log details in Data Visualization reports, I don’t know if you can directly select the Activity Formatter because it is an inline UI component rather than a single database column. The actual system field that stores those activity updates (work notes and customer-visible comments) is sys_created_by combined with the journal field comments_and_work_notes (or the individual work_notes / comments fields). When building your report or list view in Platform Analytics / Data Visualization, adding comments_and_work_notes to your selected columns will pull in the historical entries, showing the chronological log of notes and updates captured for each incident.

If you need a more granular audit trail that includes field-level changes (like state transitions or assignment updates) beyond just written notes, you should report directly on the Audit (sys_audit) or Journal Entry (sys_journal_field) tables instead of the Incident table. By querying sys_journal_field where element_idmatches your Incident sys_ids, or filtering sys_audit where tablename = incident and created >= Last Month, you can export every exact field change, old/new value, timestamp, and user action associated with those closed incidents.

[RaghavendraGund · Accepted solution]

Hello @dassan 

I replicated your requirement in PDI. 
Activity Formatter is not a field, it's a UI Component.
Activity Formatter consists of comments and worknotes + field changes + attachments + emails
1) If you want to extract only Comments and Work notes, you can directly find on the incident List view. No Customization required.(Refer Screenshot 1) --> here you get all the comments and worknotes in a single cell

2) if you want fields changes +  Comments and Work notes, you need to build a database view joining incident to sys_audit table(Refer Screenshot 2&3) ----> Here you get multiple rows per incident
Note: document key is nothing but incident sys_id.

3) if you want  fields changes +  Comments and Work notes +  emails + attachments, then there's no reliable way where you can extract everything at one place because
Attachments are stored in sys_attachment table
emails are stored sys_email table.

Please mark Helpful, if my reply added any value.

Thank You
Raghavendra G