> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flashduty.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Search and View Incidents
> Learn how to use the incident list and details page, including aggregate views, filtering, and timeline
## Incident List
Flashduty On-call provides two entry points to view the incident list. One is within a channel, the other is under the Incident Management menu. The difference is that under Incident Management, you can see incidents from multiple channels, even all incidents across the entire account.
| # | Feature | Description |
| :-: | :------------------ | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 1 | Assignee | Defaults to incidents **Assigned to Me**, can switch to view all incidents in the account |
| 2 | My Channels | Defaults to all channels, can switch to view incidents in **My Channels** |
| 3 | Processing Progress | Filter incidents by progress, defaults to **All** |
| 4 | Time Filter | Supports relative time and custom range filtering |
| 5 | Search | Supports searching by incident ID; if assignee is set to "Assigned to Me", also supports fuzzy matching on "Incident Title" |
| 6 | More Filters | Supports rich dimension filtering including severity, channels, teams, labels, or custom fields. The **Teams** filter is only visible under the global Incident Management entry and narrows incidents by the team that owns each channel |
| 7 | View Settings | Supports rich rendering options including **custom display attributes** and even aggregate views |
| 8 | Pagination | Pagination and items per page adjustment |
For query performance, the query time range is limited based on your subscription tier:
* **Free**: up to **30 days**
* **Standard**: up to **180 days**
* **Professional**: up to **366 days**
To query older data, adjust the start and end times, or use the [Incident Query API](/en/api-reference/on-call/incidents/incident-list).
To improve performance, when search conditions match more than **1000** incidents, the system only displays 1000+, not the exact number. Therefore, you can only view 1000 incidents through pagination. To see more, please adjust your search time range or use the [Incident Query API](/en/api-reference/on-call/incidents/incident-list) to get all data.
### Using Aggregate View
Aggregate view provides a different perspective for viewing incidents, where you can define different aggregation dimensions. The essence of aggregation dimensions is real-time Group By, such as viewing grouped by severity.
After switching to aggregate view, a **Grouping Rule** selector appears at the top of the list:
* **Pick an existing rule**: Click the dropdown to switch between all saved grouping rules under the current account. Each rule defines a set of Group By attributes (for example, by **Severity** + **Channel** + `labels.service`)
* **Create a rule**: At the bottom of the dropdown, click **New** to select attributes, labels, and custom fields in the popup card, name the rule, and save it for future reuse
* **Edit or delete a rule**: Hover over an existing rule to edit or delete it via the inline icons
* **Share a rule in a session**: The selected rule's `view_id` is reflected in the list URL parameter, making it easy to share the same perspective with other members
To improve performance, in aggregate view, the system matches at most **100** records for aggregation. Therefore, the list you see may not contain all matching data. If this concerns you, please switch to list view.
### Using More Filters
Flashduty On-call provides filtering capabilities across various dimensions with ample flexibility. Typical scenarios include:
* Search for incidents triggered by the "Host Down" alert policy based on `check` label
* Search for incidents marked as "false positive" based on the false alarm field
Flexibility often means lower performance, and Flashduty On-call is no exception, despite our many performance optimizations. We always recommend narrowing your query time range and using conditions like **Assigned to Me** and **Processing Progress** to reduce query scope.
### Row content
Beyond the title and progress, each incident row surfaces two key counters:
* **Associated alerts**: total number of [alerts](/en/on-call/channel/noise-reduction) grouped into this incident
* **Alert events**: cumulative count of events merged into the incident. When a new event has been merged in the past **5 minutes**, the merge icon turns orange to signal that the incident is still actively aggregating
Hovering over the counters opens a tooltip with the associated alert count, associated event count, and the relative time since the last merge.
### Custom Rendering
Click the **Settings** button in the upper right corner of the incident list to customize display content and interaction behavior:
| Option | Description |
| :--------------------- | :--------------------------------------------------------------------------------------------------------------------- |
| **Display Type** | Choose **List** or **Aggregate** view mode |
| **Detail Display** | Choose **Page** mode (navigate to a new page) or **Side Panel** mode (view details in the right panel) |
| **Auto Refresh** | Set list auto-refresh interval, or disable auto-refresh |
| **Display Attributes** | Toggle visibility of basic attribute columns such as duration, responders, channel |
| **Custom Fields** | Select platform-defined custom fields as additional display columns; if incident doesn't have this field, displays "-" |
| **Incident Labels** | Select or type label keys as additional display columns; if incident doesn't have this label, displays "-" |
## Incident Details
Incident details is the main entry point for investigating incidents, displaying all available information. Especially on the incident overview page, Flashduty On-call centrally displays the information you need most.
| # | Area | Description |
| :-: | :----------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 1 | Key Information | Incident title, severity, processing progress, ID number |
| 2 | Action Area | Various high-frequency action buttons; more actions include custom actions and low-frequency buttons; War Room creation requires enabling [War Room](/en/on-call/advanced/war-room) in IM integration. The snooze button supports customizable duration presets — you can access settings from the snooze dropdown to configure 3 preset durations (in hours or minutes), defaulting to 2 hours, 4 hours, and 12 hours |
| 3 | Details | Incident description, label info, and AI Summary (see below for details); labels support drag-to-sort and JSON view display |
| 4 | Tab Area | Use the tabs at the top to view richer content; see the **Detail Tabs** section below |
| 5 | Comprehensive Info | Centralizes supporting information such as incident attributes, key timestamps, responders, related links, images, custom fields, and external tickets (see the **Comprehensive Info Panel** section below) |
### Detail Tabs
The incident details page contains 7 tabs; some appear only under certain conditions:
| Tab | Content | Visibility |
| :-------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :------------------------------------------------------------------------------- |
| **Incident Overview** | A panoramic view including the incident summary, key attributes, recent timeline, responders, and associated events. This is the default tab when the details page opens | Always visible |
| **Associated Alerts** | All [grouped](/en/on-call/channel/noise-reduction) alerts associated with the incident, with filtering by progress and view switching | Visible only when `alert_cnt > 0` |
| **Timeline** | The complete lifecycle record of the incident — triggering, assignment, notifications, acknowledgments, snoozes, closure, comments, and more — with a Markdown comment box at the top | Always visible |
| **Change History** | Change events correlated with the current incident in time, helping you pinpoint the relationship between the incident and recent deployments or configuration changes | Always visible |
| **Resolution** | Structured fields recording the incident's impact, root cause, and resolution | Visible only when the incident has any of `impact` / `root_cause` / `resolution` |
| **Postmortem** | A built-in postmortem editor that lets you create, edit, AI-generate, and publish a postmortem report without leaving the details page | Subject to subscription tier; always visible when enabled |
| **Past Incidents** | Shows historical incidents similar to the current one, so you can draw on prior handling experience | Always visible |
### Timeline Comments
The top of the Timeline tab provides a Markdown comment box that supports:
* Writing notes, troubleshooting memos, or meeting summaries in Markdown syntax
* Pasting or uploading images directly; screenshots are auto-uploaded and converted into image links
* Appending the published comment as a record on the incident timeline, interleaved with system-generated events for easy retrospection
Posting a comment requires update permission on the incident. If you only have view access, the comment input box does not appear on the details page.
### War Room Operations
If a war room has been created for the incident (requires enabling [War Room](/en/on-call/advanced/war-room) in IM integration), the **More** menu on the action bar reveals two additional war-room management actions:
| Action | Description |
| :------------------------------- | :--------------------------------------------------------------------------------------------------------------------- |
| **Invite Followers to War Room** | Pull additional members into the existing IM war room group for multi-party collaboration |
| **Close War Room** | End the current war room and close the IM group. If collaboration is needed again later, you can create a new war room |
War-room management actions are only visible when a war room already exists for the current incident; the create action is still initiated by the **Create War Room** button on the action bar.
### Post-Mortem
The incident details page has a built-in post-mortem editor, allowing you to complete the entire post-mortem workflow without leaving the page. The action area includes a shortcut button that navigates directly to the **Post-Mortem** tab.
In the Post-Mortem tab, you can perform the following actions:
| Action | Description |
| :------------------ | :------------------------------------------------------------------------------------ |
| **Create** | Click the create button to start writing a post-mortem report |
| **AI Generate** | Use AI to auto-generate initial post-mortem content, which you can then refine |
| **Edit Title** | Modify the post-mortem report title to accurately reflect the incident |
| **Edit Content** | Write and modify post-mortem content using the rich text editor |
| **Publish** | Publish the post-mortem report to make it visible to the team |
| **Re-edit** | Published post-mortem reports can be re-opened for editing |
| **Delete** | Remove post-mortem reports that are no longer needed |
| **Export Markdown** | Export the post-mortem report as Markdown for sharing or archiving on other platforms |
See [Post-Mortem](/en/on-call/post-mortem/create-edit-post-mortem) for details.
### Change History
The Change History tab shows change events correlated with the current incident in time, helping you quickly determine whether the root cause is related to a recent deployment or configuration change.
The change event list displays the following information:
| Column | Description |
| :-------------- | :--------------------------------------------------------------------------------------- |
| **Status** | Current status of the change event, including Planned, Ready, Processing, Canceled, Done |
| **Change Key** | Unique identifier of the change event |
| **Title** | Brief description of the change event |
| **Description** | Detailed information about the change event |
| **Start Time** | When the change event started |
| **End Time** | When the change event ended |
| **Duration** | How long the change event lasted; in-progress events update in real time |
| **Link** | External link to the change event's original source |
You can adjust the query scope through the filter at the top, including time range and change source. Expand any row to view a timeline visualization of that change event, allowing comparison with the incident trigger time.
### AI Summary
The incident details page supports one-click AI summary generation to help you quickly understand the full picture of an incident. Click the **AI Summary** button in the details area, and the system will automatically generate a structured summary based on the incident's associated alerts (up to 20), including:
* **Summary**: A one-sentence description of what happened
* **Impacts**: Key affected resources such as services, systems, environments, and instances
* **Actions**: Immediately actionable investigation and remediation steps (up to 3)
You can choose from different AI models (default is DeepSeek V3; DeepSeek R1 is also available for deep thinking and reasoning capabilities) and regenerate as needed. The generated summary supports real-time streaming output and can be saved as the incident description.
AI Summary is only available for incidents automatically triggered by alerts. Manually created incidents do not support this feature.
### Comprehensive Info Panel
The comprehensive info panel on the right side of the incident details page consolidates auxiliary information around the incident. From top to bottom:
| Section | Description |
| :------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Attributes** | Basic attributes such as channel, incident trigger time, and alert count |
| **Images** | Displayed when alerts associated with the incident include image information reported via API. Click a thumbnail to preview, and hover to view the Alt description and source link |
| **Key Timestamps** | A timeline view of key timestamps in the incident lifecycle, including **trigger time**, **first acknowledgment time**, **close time**, and reopen events, so you can quickly grasp incident progress |
| **Responders** | Lists all responders (individuals or on-call personnel) assigned to the incident along with their acknowledgment status |
| **Related Links** | Shortcut links preconfigured in the owning channel (such as dashboards, runbooks, knowledge bases). Parameters are dynamically rendered from the current incident's labels or fields, enabling one-click navigation to related systems. Link templates are maintained in channel settings |
| **Custom Fields** | Displays and allows editing of the incident's custom field values; unset fields are shown as `-` |
| **External Tickets** | If you have configured ticket integrations such as Jira, ServiceNow, or ServiceDesk Plus, external tickets created from this incident appear here and can be clicked to open in the external system |
## FAQ
This error often appears on incident/alert list queries, analytics dashboards, etc. It's mainly because the system matched too much data and the query timed out.
In this case, please narrow your query scope, such as time range, or use more precise query conditions. If issues persist, please contact us.