Thanks @livehybrid Converted your finding into a case to rename the numbers. Oddly enough, when I use 'mc_incidents', I don't get any results. But I do have a working model that's almost there - it's just a bit noisy because it shows all alerts linked to a case. That's an easy fix, though; I can just export the data and do a quick pivot to tidy it up. | mcincidents | eval CaseNumber=display_id | join display_id [search index=app_servicenow | rex field=description "(?<Priority>(?<=Priority:)\s*[0-9]{1,4}|(?<=P:)\s*[0-9]{1,4})" | rex field=description "(?<CaseNumber>ES-\d{5})" | eval Priority=trim(Priority) | fields display_id CaseNumber Priority | where isnum(Priority)] | eval Priority=coalesce(Priority, Priority) | fieldformat create_time=strftime(create_time, "%c") | eval _time=create_time, id=title | spath output=collaborators input=collaborators path={}.name | sort -create_time | eval age=toString(now()-create_time, "duration") | eval new_time=strftime(create_time,"%Y-%m-%d %H:%M:%S.%N") | eval time=rtrim(new_time,"0") | eval status_name=case( status == "0", "Unassigned", status == "1", "New", status == "2", "In Progress", status == "3", "Pending", status == "4", "Resolved", status == "5", "Closed", true(), "Unknown" ) | table time, age, status_name, CaseNumber, Priority, name, assignee now to battle the constant SVC Limit searches being aborted (customer is aware of these)
... View more
