Incident List
Flashduty On-call provides two entry points to view the incident list. One is within a channel, the other is under the Incident Management menu. The difference is that under Incident Management, you can see incidents from multiple channels, even all incidents across the entire account.
| # | Feature | Description |
|---|---|---|
| 1 | Assignee | Defaults to incidents Assigned to Me, can switch to view all incidents in the account |
| 2 | My Channels | Defaults to all channels, can switch to view incidents in My Channels |
| 3 | Processing Progress | Filter incidents by progress, defaults to All |
| 4 | Time Filter | Supports relative time and custom range filtering |
| 5 | Search | Supports searching by incident ID; if assignee is set to “Assigned to Me”, also supports fuzzy matching on “Incident Title” |
| 6 | More Filters | Supports rich dimension filtering including severity, labels, or custom fields |
| 7 | View Settings | Supports rich rendering options including custom display attributes and even aggregate views |
| 8 | Pagination | Pagination and items per page adjustment |
To improve performance, when search conditions match more than 1000 incidents, the system only displays 1000+, not the exact number. Therefore, you can only view 1000 incidents through pagination. To see more, please adjust your search time range or use the Incident Query API to get all data.
Using Aggregate View
Aggregate view provides a different perspective for viewing incidents, where you can define different aggregation dimensions. The essence of aggregation dimensions is real-time Group By, such as viewing grouped by severity.
To improve performance, in aggregate view, the system matches at most 100 records for aggregation. Therefore, the list you see may not contain all matching data. If this concerns you, please switch to list view.
Using More Filters
Flashduty On-call provides filtering capabilities across various dimensions with ample flexibility. Typical scenarios include:- Search for incidents triggered by the “Host Down” alert policy based on
checklabel - Search for incidents marked as “false positive” based on the false alarm field
Custom Rendering
Click the Settings button in the upper right corner of the incident list to customize display content and interaction behavior:| Option | Description |
|---|---|
| Display Type | Choose List or Aggregate view mode |
| Detail Display | Choose Page mode (navigate to a new page) or Side Panel mode (view details in the right panel) |
| Auto Refresh | Set list auto-refresh interval, or disable auto-refresh |
| Display Attributes | Toggle visibility of basic attribute columns such as duration, responders, channel |
| Custom Fields | Select platform-defined custom fields as additional display columns; if incident doesn’t have this field, displays ”-“ |
| Incident Labels | Select or type label keys as additional display columns; if incident doesn’t have this label, displays ”-“ |
Incident Details
Incident details is the main entry point for investigating incidents, displaying all available information. Especially on the incident overview page, Flashduty On-call centrally displays the information you need most.
| # | Area | Description |
|---|---|---|
| 1 | Key Information | Incident title, severity, processing progress, ID number |
| 2 | Action Area | Various high-frequency action buttons; more actions include custom actions and low-frequency buttons; War Room creation requires enabling War Room in IM integration. The snooze button supports customizable duration presets — you can access settings from the snooze dropdown to configure 3 preset durations (in hours or minutes), defaulting to 2 hours, 4 hours, and 12 hours |
| 3 | Details | Incident description, label info, and AI Summary (see below for details); labels support drag-to-sort and JSON view display |
| 4 | Associated Alerts | All grouped alerts associated with the incident, supports filtering by progress and view switching |
| 5 | Comprehensive Info | Shows incident attributes, processing status, images, and responder info |
| 6 | Custom Fields | Custom field configuration area |
Post-Mortem
The incident details page has a built-in post-mortem editor, allowing you to complete the entire post-mortem workflow without leaving the page. The action area includes a shortcut button that navigates directly to the Post-Mortem tab. In the Post-Mortem tab, you can perform the following actions:| Action | Description |
|---|---|
| Create | Click the create button to start writing a post-mortem report |
| AI Generate | Use AI to auto-generate initial post-mortem content, which you can then refine |
| Edit Title | Modify the post-mortem report title to accurately reflect the incident |
| Edit Content | Write and modify post-mortem content using the rich text editor |
| Publish | Publish the post-mortem report to make it visible to the team |
| Re-edit | Published post-mortem reports can be re-opened for editing |
| Delete | Remove post-mortem reports that are no longer needed |
| Export Markdown | Export the post-mortem report as Markdown for sharing or archiving on other platforms |
Change History
The Change History tab shows change events correlated with the current incident in time, helping you quickly determine whether the root cause is related to a recent deployment or configuration change. The change event list displays the following information:| Column | Description |
|---|---|
| Status | Current status of the change event, including Planned, Ready, Processing, Canceled, Done |
| Change Key | Unique identifier of the change event |
| Title | Brief description of the change event |
| Description | Detailed information about the change event |
| Start Time | When the change event started |
| End Time | When the change event ended |
| Duration | How long the change event lasted; in-progress events update in real time |
| Link | External link to the change event’s original source |
AI Summary
The incident details page supports one-click AI summary generation to help you quickly understand the full picture of an incident. Click the AI Summary button in the details area, and the system will automatically generate a structured summary based on the incident’s associated alerts (up to 20), including:- Summary: A one-sentence description of what happened
- Impacts: Key affected resources such as services, systems, environments, and instances
- Actions: Immediately actionable investigation and remediation steps (up to 3)
Images
When alerts associated with the incident include image information reported via API, the incident details right panel displays an Images section. You can click image thumbnails to preview them, and hover to view the Alt description and source links.Linked External Tickets
If you have configured ticket integrations such as Jira, ServiceNow, or ServiceDesk Plus, the comprehensive info area in the incident details right panel displays linked external ticket information. You can click directly to navigate to the corresponding external ticket system and view details.FAQ
Console error: Due to the large volume of data, we are unable to respond...
Console error: Due to the large volume of data, we are unable to respond...
This error often appears on incident/alert list queries, analytics dashboards, etc. It’s mainly because the system matched too much data and the query timed out.In this case, please narrow your query scope, such as time range, or use more precise query conditions. If issues persist, please contact us.