> ## Documentation Index
> Fetch the complete documentation index at: https://test-8ad8522e-feat-ai-sre.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Search and View Incidents
> Learn how to use the incident list and details page, including aggregate views, filtering, and timeline
## Incident List
Flashduty On-call provides two entry points to view the incident list. One is within a channel, the other is under the Incident Management menu. The difference is that under Incident Management, you can see incidents from multiple channels, even all incidents across the entire account.
| # | Feature | Description |
| :-: | :------------------ | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 1 | Assignment toggle | A three-state control at the head of the filter bar: **All** / **Assigned to Me** (incidents where I am a responder) / **My Teams** (incidents in channels I belong to). It is mutually exclusive with the **Responders** and **Channels** filters in More Filters: manually selecting either one resets the toggle to **All** (manual selection takes precedence and is kept); the toggle only applies once those manual filters are cleared |
| 2 | Time Filter | Supports relative time and custom range filtering |
| 3 | Severity | Filter incidents by severity |
| 4 | Processing Progress | Filter incidents by progress, defaults to **All** |
| 5 | More Filters | Supports rich dimension filtering, including responders, channels, creator, acknowledger, closer, teams, snooze status, ever converged due to flapping, rare incidents, labels, and custom fields. The **Channels** and **Teams** filters are only visible under the global Incident Management entry, and Teams narrows incidents by the team that owns each channel |
| 6 | Search | Located at the end of the filter bar, supports searching by incident title, ID, labels, and custom fields. After an incident's title, labels, or custom fields are updated, query results may be slightly delayed |
| 7 | View Settings | Supports rich rendering options including **custom display attributes** and even aggregate views |
| 8 | Pagination | Pagination and items per page adjustment |
For query performance, the query time range is limited based on your subscription tier:
* **Free**: up to **30 days**
* **Standard**: up to **180 days**
* **Professional**: up to **366 days**
To query older data, adjust the start and end times, or use the [Incident Query API](/en/api-reference/on-call/incidents/incident-list).
To improve performance, when search conditions match more than **1000** incidents, the system only displays 1000+, not the exact number. Therefore, you can only view 1000 incidents through pagination. To see more, please adjust your search time range or use the [Incident Query API](/en/api-reference/on-call/incidents/incident-list) to get all data.
### Using Aggregate View
Aggregate view provides a different perspective for viewing incidents, where you can define different aggregation dimensions. The essence of aggregation dimensions is real-time Group By, such as viewing grouped by severity.
After switching to aggregate view, a **Grouping Rule** selector appears at the top of the list:
* **Pick an existing rule**: Click the dropdown to switch between all saved grouping rules under the current account. Each rule defines a set of Group By attributes (for example, by **Severity** + **Channel** + `labels.service`)
* **Create a rule**: At the bottom of the dropdown, click **New** to select attributes, labels, and custom fields in the popup card, name the rule, and save it for future reuse
* **Edit or delete a rule**: Hover over an existing rule to edit or delete it via the inline icons
* **Share a rule in a session**: The selected rule's `view_id` is reflected in the list URL parameter, making it easy to share the same perspective with other members
To improve performance, in aggregate view, the system matches at most **100** records for aggregation. Therefore, the list you see may not contain all matching data. If this concerns you, please switch to list view.
### Using More Filters
Flashduty On-call provides filtering capabilities across various dimensions with ample flexibility. Typical scenarios include:
* Search for incidents triggered by the "Host Down" alert policy based on `check` label
* Search for incidents marked as "false positive" based on the false alarm field
Flexibility often means lower performance, and Flashduty On-call is no exception, despite our many performance optimizations. We always recommend narrowing your query time range and using conditions like **Assigned to Me** and **Processing Progress** to reduce query scope.
### Saving Filter Views
The **Saving Filter Views** feature is temporarily offline. The filter bar currently offers no entry point for saving, applying, or managing filter views. It will be restored in a future release — stay tuned.
You can save the current filter conditions on the filter bar as a named **filter view** and reapply it with one click later — ideal for frequently used search combinations:
* **Save a view**: After configuring your filter conditions, save them as a named view; names must be unique, and each user can save at most **10** views
* **Apply a view**: Select a saved view to apply its filter conditions to the current list
* **Manage views**: Saved views support **renaming**, **updating** (overwriting the view with the current filter conditions), and **deletion**
Filter views are saved per user and are only visible to you. A view saves all filter conditions except the **time range** — when you apply a view, the time range keeps your current selection.
### Row content
Beyond the title and progress, each incident row surfaces two key counters:
* **Associated alerts**: total number of [alerts](/en/on-call/channel/noise-reduction) grouped into this incident
* **Alert events**: cumulative count of events merged into the incident. When a new event has been merged in the past **5 minutes**, the merge icon turns orange to signal that the incident is still actively aggregating
Hovering over the counters opens a tooltip with the associated alert count, associated event count, and the relative time since the last merge.
### Batch Operations
After selecting one or more incidents in the list, use the action bar above the list to perform batch operations:
| Operation | Description |
| :-------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Acknowledge** | Acknowledge the selected incidents in bulk |
| **Snooze** | Snooze the selected incidents in bulk. Choose a quick duration preset (defaulting to 2, 4, and 12 hours — open settings from the dropdown to configure 3 presets) or a custom duration (in hours or minutes, up to 30 days). Only incidents in the Processing state can be snoozed; the button is disabled if your selection contains incidents in other states |
| **Assign** | Assign the selected incidents to specific members in bulk. Closed incidents cannot be assigned; the button is disabled if your selection contains closed incidents |
| **Close** | Close the selected incidents in bulk |
| **Merge** | Merge the selected incidents into a single incident |
| **AI Analysis** | Send the selected incidents as context to the AI SRE Agent for batch analysis. Requires the AI SRE module to be enabled with the corresponding permission; if all selected incidents belong to the same team, that team is automatically used as the conversation scope |
Except for **AI Analysis**, the above batch operations require incident update permission.
### Custom Rendering
Click the **Settings** button in the upper right corner of the incident list to customize display content and interaction behavior:
| Option | Description |
| :--------------------- | :--------------------------------------------------------------------------------------------------------------------- |
| **Display Type** | Choose **List** or **Aggregate** view mode |
| **Detail Display** | Choose **Page** mode (navigate to a new page) or **Side Panel** mode (view details in the right panel) |
| **Auto Refresh** | Set list auto-refresh interval, or disable auto-refresh |
| **Display Attributes** | Toggle visibility of basic attribute columns such as duration, responders, channel |
| **Custom Fields** | Select platform-defined custom fields as additional display columns; if incident doesn't have this field, displays "-" |
| **Incident Labels** | Select or type label keys as additional display columns; if incident doesn't have this label, displays "-" |
## Incident Details
Incident details is the main entry point for investigating incidents, displaying all available information. Especially on the incident overview page, Flashduty On-call centrally displays the information you need most.
| # | Area | Description |
| :-: | :----------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 1 | Key Information | Incident title, severity, processing progress, ID number |
| 2 | Action Area | Various high-frequency action buttons; more actions include custom actions and low-frequency buttons; War Room creation requires enabling [War Room](/en/on-call/advanced/war-room) in IM integration. The snooze button supports customizable duration presets — you can access settings from the snooze dropdown to configure 3 preset durations (in hours or minutes), defaulting to 2 hours, 4 hours, and 12 hours |
| 3 | Details | Incident description, label info, and AI Summary (see below for details); labels support drag-to-sort and JSON view display |
| 4 | Tab Area | Use the tabs at the top to view richer content; see the **Detail Tabs** section below |
| 5 | Comprehensive Info | Centralizes supporting information such as incident attributes, key timestamps, responders, related links, images, custom fields, and external tickets (see the **Comprehensive Info Panel** section below) |
### Label Deep Links
Incident labels are displayed in the **Details** area of the details page. When an incident is aggregated from alerts produced by a monitoring integration (`monit.alert`) or a RUM integration (`rum.alert`), certain label values are rendered as deep links, letting you jump straight to the rule or issue that generated the alert:
| Integration Type | Label Key | Link Behavior |
| :--------------- | :----------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `rum.alert` | `issue_id` | A **View Issue** link is rendered next to the label value, jumping to the corresponding issue in RUM error tracking |
| `monit.alert` | `rule_id` | A **View Rule** link is rendered next to the label value, jumping to the standalone alert rule that generated the alert |
| `monit.alert` | `__alert_rule_id` | A **View Rule** link is rendered next to the label value, jumping to the standalone alert rule that generated the alert. New data prefers this label; historical data falls back to `rule_id` |
| `monit.alert` | `__entity_alert_rule_id` | A **View Rule** link is rendered next to the label value, jumping to the edit view of the corresponding alert rule in the entity tree |
Jumping to an entity-tree rule requires contextual labels such as `__entity_alert_account_id`, `__entity_alert_entity_definition_id`, `__entity_alert_data_source_id`, and `__entity_alert_policy_scope_group_id` for locating; when any required label is missing or invalid, the label value is shown as plain text. Standalone alert rules (`rule_id` / `__alert_rule_id`) likewise require a positive integer value (e.g. `123`); when the value is empty, `0`, or non-numeric, the label is shown as plain text to avoid generating an invalid link. This deep-link capability also applies to the label area of the alert details page.
Additionally, when a label carries query-type information (such as the PromQL / log expression that was active when the alert triggered), an **Explore** icon appears on the right side of the label row. Clicking it opens the Query Workbench in a new tab, pre-filled with the alert's triggering query and a time window set around the alert's start time. A single query links directly; multiple queries (primary + related) display a popover list for selection.
### Detail Tabs
The incident details page contains 7 tabs; some appear only under certain conditions:
| Tab | Content | Visibility |
| :-------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------- |
| **Incident Overview** | A panoramic view including the incident summary, key attributes, recent timeline, responders, and associated events. This is the default tab when the details page opens | Always visible |
| **Associated Alerts** | All [grouped](/en/on-call/channel/noise-reduction) alerts associated with the incident, with filtering by progress and view switching | Visible only when `alert_cnt > 0` |
| **Timeline** | The complete lifecycle record of the incident — triggering, assignment, reassignment, responder changes, notifications, acknowledgments, snoozes, closure, comments, and action-item and follow-up operations such as creation, updates, and completion — with a Markdown comment box at the top | Always visible |
| **Change History** | Change events correlated with the current incident in time, helping you pinpoint the relationship between the incident and recent deployments or configuration changes | Always visible |
| **Resolution** | Structured fields recording the incident's impact, root cause, and resolution | Visible only when the incident has any of `impact` / `root_cause` / `resolution` |
| **Postmortem** | A built-in postmortem editor that lets you create, edit, AI-generate, and publish a postmortem report without leaving the details page | Subject to subscription tier; always visible when enabled |
| **Past Incidents** | Shows historical incidents similar to the current one, so you can draw on prior handling experience | Always visible |
### Action Item and Follow-Up Events
Every operation on [action items and follow-ups](/en/on-call/incident/work-items) is written to the timeline as an iconized record, displayed alongside comments, acknowledgments, and other events. The supported event types are:
| Event Type | Timeline Record |
| :--------------- | :----------------------------------------------------- |
| `i_wi_created` | Created action / Created follow-up |
| `i_wi_updated` | Updated action / Updated follow-up |
| `i_wi_assignees` | Updated action assignees / Updated follow-up assignees |
| `i_wi_completed` | Completed action / Completed follow-up |
| `i_wi_converted` | Converted action to follow-up |
| `i_wi_bound` | Linked follow-up to post-incident review |
| `i_wi_deleted` | Deleted action / Deleted follow-up |
### Timeline Comments
The top of the Timeline tab provides a Markdown comment box that supports:
* Writing notes, troubleshooting memos, or meeting summaries in Markdown syntax
* Pasting or uploading images directly; screenshots are auto-uploaded and converted into image links
* Clicking an image in a comment opens the original image in a new tab (no in-page preview)
* Mentioning members with @ in a comment — the mentioned member receives a dedicated personal notification (with the comment content and an incident link, delivered by email and Flashduty App push by default), making it easy to pull the right people into the discussion
* Appending the published comment as a record on the incident timeline, interleaved with system-generated events for easy retrospection
@mention notifications are dedicated personal notifications and are not affected by notification muting such as snooze or silence rules.
Posting a comment requires update permission on the incident. On the Timeline tab, the comment input box is always visible to all members, but only members with incident update permission see the **Send** button. On the incident overview page's "Recent Timeline" section, the **Leave Comment** button and the comment input box it opens are likewise visible only to members with update permission.
### Comment Types
Comments can carry a **comment type** tag to distinguish their nature on the timeline (for example, "root cause analysis" or "handling progress"):
* When posting a comment, use the **Comment type** selector next to the comment box to assign a type, or choose **No comment type**; the timeline record shows the comment type as a colored tag
* Comment types are configured at the **account level** and apply to all incidents under the current account; renaming or recoloring a type also affects historical comments
* The selector next to the comment box only appears when the account already has comment types, or when you have comment-type management permission
Members with comment-type management permission (`incidentCommentType:manage`) can open the **Manage comment types** dialog from the selector and perform the following operations:
| Operation | Description |
| :------------------ | :------------------------------------------------------------------------------------------------------------------------------ |
| **Create** | Enter a name (up to **40** characters) and pick a color (6 preset colors, plus a custom picker); up to **10** types per account |
| **Rename** | Edit the name in place (up to **40** characters); the change also applies to historical comments |
| **Recolor** | Change the color with the color picker; this also applies to historical comments |
| **Drag to reorder** | Drag types to change their order, which determines how they appear in the selector |
| **Delete** | After deletion, historical comments will no longer show this type |
The operations and limits above (name up to **40** characters, 6 preset colors plus a custom picker, up to **10** types per account) apply to the **Manage comment types** dialog in the console. In the Flashduty App (mobile), the comment type selector behaves differently:
* Types appear as pills above the comment box, with 3 types shown inline in a row and the rest collected into a **More** panel; the selected type is always kept in the inline row, and tapping it again deselects it
* With management permission, you can **create** a type directly in the **More** panel: the name is limited to **20** characters, and the color picker offers 30 preset colors (6 common presets plus 24 palette colors); there is no custom color picker
* Renaming, recoloring, deleting, and reordering must be done in the console
### War Room Operations
If a war room has been created for the incident (requires enabling [War Room](/en/on-call/advanced/war-room) in IM integration), the **More** menu on the action bar reveals two additional war-room management actions:
| Action | Description |
| :------------------------------- | :--------------------------------------------------------------------------------------------------------------------- |
| **Invite Followers to War Room** | Pull additional members into the existing IM war room group for multi-party collaboration |
| **Close War Room** | End the current war room and close the IM group. If collaboration is needed again later, you can create a new war room |
War-room management actions are only visible when a war room already exists for the current incident; the create action is still initiated by the **Create War Room** button on the action bar.
In the Flashduty App (mobile), war room behavior matches the console: the incident overview page shows a **War room** entry card (IM integrations with deep-link support open the chat directly; otherwise a dialog shows the group name to search for); **Create war room** lives in **More Actions** at the bottom, hidden when the incident already has a war room or is closed, and disabled with a toast when the incident has no responders; **Add stakeholders to war room** and **Dissolve war room** remain available after the incident is closed and do not depend on whether the IM integration is still enabled.
### Post-Mortem
The incident details page has a built-in post-mortem editor, allowing you to complete the entire post-mortem workflow without leaving the page. The action area includes a shortcut button that navigates directly to the **Post-Mortem** tab.
In the Post-Mortem tab, you can perform the following actions:
| Action | Description |
| :------------------ | :------------------------------------------------------------------------------------ |
| **Create** | Click the create button to start writing a post-mortem report |
| **AI Generate** | Use AI to auto-generate initial post-mortem content, which you can then refine |
| **Edit Title** | Modify the post-mortem report title to accurately reflect the incident |
| **Edit Content** | Write and modify post-mortem content using the rich text editor |
| **Publish** | Publish the post-mortem report to make it visible to the team |
| **Re-edit** | Published post-mortem reports can be re-opened for editing |
| **Delete** | Remove post-mortem reports that are no longer needed |
| **Export Markdown** | Export the post-mortem report as Markdown for sharing or archiving on other platforms |
See [Post-Mortem](/en/on-call/post-mortem/create-edit-post-mortem) for details.
### Change History
The Change History tab shows change events correlated with the current incident in time, helping you quickly determine whether the root cause is related to a recent deployment or configuration change.
The change event list displays the following information:
| Column | Description |
| :-------------- | :--------------------------------------------------------------------------------------- |
| **Status** | Current status of the change event, including Planned, Ready, Processing, Canceled, Done |
| **Change Key** | Unique identifier of the change event |
| **Title** | Brief description of the change event |
| **Description** | Detailed information about the change event |
| **Start Time** | When the change event started |
| **End Time** | When the change event ended |
| **Duration** | How long the change event lasted; in-progress events update in real time |
| **Link** | External link to the change event's original source |
You can adjust the query scope through the filter at the top, including time range and change source. Expand any row to view a timeline visualization of that change event, allowing comparison with the incident trigger time.
### AI Summary
The incident details page supports one-click AI summary generation to help you quickly understand the full picture of an incident. Click the **AI Summary** button in the details area, and the system will automatically generate a structured summary based on the incident's associated alerts (up to 20), including:
**Plan requirement**: This feature requires an On-call Pro or higher subscription. [Learn more](https://flashcat.cloud/flashduty/price/)
* **Summary**: A one-sentence description of what happened
* **Impacts**: Key affected resources such as services, systems, environments, and instances
* **Actions**: Immediately actionable investigation and remediation steps (up to 3)
AI Summary is always generated with the DeepSeek V4 Pro (`deepseek-v4-pro`) model; the console does not offer a model selector. The generated summary supports real-time streaming output, can be regenerated, and can be saved as the incident description.
AI Summary is only available for incidents automatically triggered by alerts. Manually created incidents do not support this feature.
### Comprehensive Info Panel
The comprehensive info panel on the right side of the incident details page consolidates auxiliary information around the incident. From top to bottom:
| Section | Description |
| :------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Attributes** | Basic attributes such as channel, incident trigger time, and alert count |
| **Images** | Displayed when alerts associated with the incident include image information reported via API. Click a thumbnail to preview, and hover to view the Alt description and source link |
| **Key Timestamps** | A timeline view of key timestamps in the incident lifecycle, including **trigger time**, **first acknowledgment time**, **close time**, and reopen events, so you can quickly grasp incident progress |
| **Responders** | Lists all responders (individuals or on-call personnel) assigned to the incident along with their acknowledgment status |
| **Related Links** | Shortcut links preconfigured in the owning channel (such as dashboards, runbooks, knowledge bases). Parameters are dynamically rendered from the current incident's labels or fields, enabling one-click navigation to related systems. Link templates are maintained in channel settings |
| **Custom Fields** | Displays and allows editing of the incident's custom field values; unset fields are shown as `-` |
| **External Tickets** | If you have configured ticket integrations such as Jira, ServiceNow, or ServiceDesk Plus, external tickets created from this incident appear here and can be clicked to open in the external system |
## FAQ
This error often appears on incident/alert list queries, analytics dashboards, etc. It's mainly because the system matched too much data and the query timed out.
In this case, please narrow your query scope, such as time range, or use more precise query conditions. If issues persist, please contact us.