When trying to filter "new" incidents, how do I get all results not just reolved?

[NizanCohen]

Hi.

I work with ServiceNow, a ticketing platform. 

I wish to get only the current "new" incidents and display it in a dashboard, but when I put "| search status=New" I get results which turned "resolved" already.

Is there a way I can display only the current new incidents?

[kamlesh_vaghela · Accepted solution]

@NizanCohen 

Can you please try this?

index=YOUR_INDEX OTHER_SEARCH_TERMS_IN_CASE
| dedup INCIDENT_FIELD_NAME
| rename comment as "dedup for fetching latest incident event"
| search status=New
| table YOUR_REQUIRED_FIELDS

In case you still face issues then please share some sample data with INCIDENT_FIELD_NAME and the status field.

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.