SLA Total Duration field in incident table

[JoshBoyd]

I can query successfully tickets that have an SLA > than X seconds.

What I'm having trouble with is displaying a field in the incident table. 

For example:  If i pull back tickets that have an SLA.TotalDuration > 2 days, I want to see the tickets and sort by the longest running SLA and see how much we went over by, but I can't do that because when i add the SLA field I don't see a way to display the total duration only this:

This shows when the SLA is due and how much time is remaining, but not the total duration.

I want something that looks like this on the incident table:

I think the difference is my Time to Assignment SLA doesn't have a due date so it shows the total duration by default.

Any advice is appreciated - 

Thanks!

[jfernandes1 · Accepted solution]

Hi @JoshBoyd, while configuring the field if you set a threshold the field is considered as a timer field, this is a count-up timer. If you do not set a threshold it is considered as an SLA field which is count-down timer. 

For your specific use you will need to create custom widget with a script. Refer - https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Create...