See incident number in sys_audit table

[#1]

Our help desk would like to search sys_audit to look specific changes (urgency and priority changes, etc.). Is there a way to be able to see the incident id in the audit log and is it possible to relate the audit record to the incident record for reporting.

[john_roberts]

There are a couple of ways to view the audit events from an incident. You can right-click in the incident bar and select history, this is best if you only need the information occasionally.
If you want to show the audit events on the incident form you can add them using the personalize lists from the form and adding audit records.
You can also create reports on the sys_audit table, but it's not that clear since the incident number only exists on the records for the number field. The documentkey field is what links it to a specific incident sys_id.

[#3]

Thanks John. There in is my problem. How can you reference the incident and sys_audit tables so you can query sys_audit and then be able to get information from incidents to be able to create a meaningful report? Checking the history log of each record is not practical when you create a lot of records weekly. Looking for trends in sys_audit helps zero in on things that need to be reviewed but that falls short because you cannot easily identify the incident. Having the ability to query sys_audit and with the ability to pull data from the incident would be very useful. If there is not an easy way, I will add this to the list of reporting enhancement request.

[john_roberts]

This fits in with a number of other reporting requests, having the ability to link tables from reports. The only other solution that I know of is to create a new table and populate the events and fields you need to report on using scripts, then report against that table. Go ahead and submit an enhancement, maybe someone else will come up with an easier solution.

[#5]

I am also interested in how you get to the incident table through the sys_audit table. I am looking for assigned_to field on the incident, but need the incident number to show on a report so I can look up the incident.