Query For Recently Resolved Incidents

#1

I am running a query to get some incident history. However, the since and until parameters only seem to work on incident creation time. I would like to do a query along the lines of “What are all the incidents from this service that were resolved in the last 24 hours?” Is there an easy way to do this?
Some incidents might be opened for several weeks (or even months) before being resolved, and we have enough incidents where a query that spans a month or so can take maybe five minutes or so and return tens of thousands of incidents, most of which I don’t care about because they were resolved before the last 24 hours.

#2

You should be able to use our Get Incidents endpoint to query for resolved incidents within your chosen timeframe (up to 6 months at a time). If that isn’t working for you, please post your CURL here so we can take a look!

#3

The thing is, I don’t want all resolved incidents. I want ones that were specifically resolved in the last 24 hours, even though they may have been opened a week or so ago. I’m not seeing anything in the Get Incidents that lets me specifically ask for “last_status_change_at”, just “created_at”.

#4

I’m also trying to get resolved incidents from the past 24 hours however. The API reference https://api-reference.pagerduty.com/#!/Incidents/get_incidents says I should be able to sort on “resolved_at:desc” however “resolved_at:desc” and “resolved_at:asc” both return the oldest incidents in the account instead of the most recent.

This seems like either a bug in the API or the API documentation. Another questions here also seems related but no resolution provided /forum/t/sort-by-resolved-at-in-incidents-api/1001

I’m using the python binding with the following params for incidents endpoint

params={‘statuses[]’:‘resolved’, ‘date_range’: ‘all’, ‘sort_by’: ‘resolved_at:desc’}

#5

Hi @timr, there isn’t a filter for the timestamp that an incident was resolved at this endpoint. The only way to do this would be to do a GET on all incidents created in a given timeframe, and then iterate through each one and do a GET on its log entries:

https://api-reference.pagerduty.com/#!/Incidents/get_incidents_id_log_entries

In the response, you would then need to parse for "type": "resolve_log_entry" and refer to the "created_at" value.

#6

OK, good to know. I am doing that now, and was just wondering if there was a faster way.