Hi all,
I have created a database view where I need to combine security incidents opened by "x user". and the sys_user table. I need some help with the where clause to connect the tables and show the user's details based on Security incidents opened by "x user". Any help is appreciated.
Hello @Wendy20 ,
I misread your comment, I thought you want all incidents for which Assigned To is Beth Anglin. However, if you want to get incidents opened by Beth Anglin you can use below mentioned WHERE clause and that will work for you:
Incident --> Order: 100 --> inc_opened_by="46d44a23a9fe19810012d100cca80666"
User -- Order: 200 --> inc_assigned_to=usr_sys_id
If my answer has helped with your question, please mark it as correct and give it a thumbs up!
Regards,
Shubham
Hi @Wendy20 ,
You can write a where clause for "sys_user" table mentioning from which field on Security Incident do you want to map the user. (In your case it is assigned_to)
Please refer below example: (I have used Incident table for example, you can replace the same with Security Incident)
You can then add all required User fields on database view by editing List Layout.
If my answer has helped with your question, please mark it as helpful and give it a thumbs up!
Regards,
Shubham
Hello @Wendy20 ,
Glad that it helped you. Yes, there's a way to achieve that, you can make some slight changes in your Database View like below and it should work:
Move the sys_user table to first row by changing it's order and then query it with the sys_id of the user "Beth Anglin".
You can also query the user table with user_id instead of sys_id by using usr_user_name="beth.anglin".
If my answer has helped with your question, please mark it as correct and give it a thumbs up!
Regards,
Shubham
I tried this but when I added the where clause on user sys id and tried I was unable to see any records. Any advice? Thank you!
