SLA Total Duration field in incident table

JoshBoyd — Tue, 27 Dec 2022 20:19:11 GMT

I can query successfully tickets that have an SLA > than X seconds.

What I'm having trouble with is displaying a field in the incident table.

For example: If i pull back tickets that have an SLA.TotalDuration > 2 days, I want to see the tickets and sort by the longest running SLA and see how much we went over by, but I can't do that because when i add the SLA field I don't see a way to display the total duration only this:

This shows when the SLA is due and how much time is remaining, but not the total duration.

I want something that looks like this on the incident table:

I think the difference is my Time to Assignment SLA doesn't have a due date so it shows the total duration by default.

Any advice is appreciated -

Thanks!

Re: SLA Total Duration field in incident table

jfernandes1 — Wed, 28 Dec 2022 03:05:04 GMT

Hi @JoshBoyd, while configuring the field if you set a threshold the field is considered as a timer field, this is a count-up timer. If you do not set a threshold it is considered as an SLA field which is count-down timer.

For your specific use you will need to create custom widget with a script. Refer - https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Create-a-Custom-Widget-Using-an-Automation-Script

topic SLA Total Duration field in incident table in Cortex XSOAR Discussions

SLA Total Duration field in incident table

Re: SLA Total Duration field in incident table