How to find incidents with a particular key present in context ?

[bhargav_11]

whenever there is an email thread involved in the incident,  a field in the context is created as EmailThreads: [{email1 values}, {email 2 values}]

I want to find all the incidents which have this email thread involved.

[amontminy]

To find all incidents that have a value assigned to EmailThreads, you can use this filter: 

-emailthreads:""

This shows all incidents where the EmailThreads fields is not empty. This relies on the machine name of the field so if it is not emailthreads you will need to adjust it. Hope this helps!

[bhargav_11]

This is my context I have ExtractedFields as a dictionary with several values in it.

When i do -ExtractedFields: "" its not showing the incident.
@amontminy 

[amontminy]

In that screenshot, ExtractedFields is in the context of the incident but is not being used as a field in the incident. Only incident fields are indexed and are filterable since the amount of data in context can be overwhelming. Only the subset of data under incident can be used to filter. In its current state you can't filter based on ExtractedFields, you would need to create it as an incident field first, then it would be filterable.

[bhargav_11]

But its only getting created in the context and not in the incident.
There is already automation in place that created this in the context and if i create a custom field as well it won't create a duplicate entry in the incident right ?

@amontminy