How to find incidents with a particular key present in context ?

[bhargav_11]

whenever there is an email thread involved in the incident,  a field in the context is created as EmailThreads: [{email1 values}, {email 2 values}]

I want to find all the incidents which have this email thread involved.

[amontminy]

To find all incidents that have a value assigned to EmailThreads, you can use this filter: 

-emailthreads:""

This shows all incidents where the EmailThreads fields is not empty. This relies on the machine name of the field so if it is not emailthreads you will need to adjust it. Hope this helps!

[bhargav_11]

This is my context I have ExtractedFields as a dictionary with several values in it.

When i do -ExtractedFields: "" its not showing the incident.
@amontminy 

[amontminy]

In that screenshot, ExtractedFields is in the context of the incident but is not being used as a field in the incident. Only incident fields are indexed and are filterable since the amount of data in context can be overwhelming. Only the subset of data under incident can be used to filter. In its current state you can't filter based on ExtractedFields, you would need to create it as an incident field first, then it would be filterable.

[bhargav_11]

But its only getting created in the context and not in the incident.
There is already automation in place that created this in the context and if i create a custom field as well it won't create a duplicate entry in the incident right ?

@amontminy 

[amontminy]

It would duplicate the item in context to an incident field. Which automation are you using?

[chrking]

You can use the mapping options in the task configuration in the playbook editor or a separate setIncident task to write the data to a custom field on the incident.

[SanDev]

The one in incident context subset will be called "incident.ExtractedFields" in case you want to keep the original name.