I need a way to search Action Log or History, is there any way to do this?

Jason_Meyer

I need a way to search Action Log or History, is there any way to do this?

Justin_Workman

You can search for comments using global search or comment search. Searching history is a little more tricky. What exactly are you trying to search for?

Jason_Meyer

I need to find a way to report on how many requests my staff have worked on but did not create and are not currently assigned the request.

Adam_Dzyacky

Hrmmm...

I threw together a quick script that gets all Incidents (I am not entirely comfortable with the lack of filtering here. Maybe filter on all Closed? Active? Almost anything would be better than a blanket all) then parses the History to figure out if the change made was made by someone who is not the Created By/Assigned To User. Finally, it shows the number of Incidents modified as seen in the form of "Total Incidents modified: X".

This isn't perfect because the Assigned To could be blank, so just keep that in mind as you begin looking over results. Otherwise, apart from adding a filter of your choice is updating the $environment variable that way you should be able to do this all remotely.

#declare variables/classes
$environment = "mgmtServer"
$irClass = get-scsmclass -name "system.workitem.incident$" -computername $environment
$createdByUserRelClass = get-scsmrelationshipclass -name "System.WorkItemCreatedByUser$" -computername $environment
$assignedUserRelClass = get-scsmrelationshipclass -name "System.WorkItemAssignedToUser$" -computername $environment

#get incident objects
$incidents = get-scsmobject -class $irClass -computername $environment

#declare an empty value
$modifiedIncidents = 0

foreach ($incident in $incidents)
{
    #get the created/assigned users
    $createdUserRelObject = get-scsmrelationshipobject -bysource $incident -computername $environment | ?{($_.RelationshipId -eq $createdByUserRelClass.Id) -and ($_.SourceObject.Classname -eq "System.WorkItem.Incident")} | select targetobject -expandproperty targetobject
    $assignedUserRelObject = get-scsmrelationshipobject -bysource $incident -computername $environment | ?{($_.RelationshipId -eq $assignedUserRelClass.Id) -and ($_.SourceObject.Classname -eq "System.WorkItem.Incident")} | select targetobject -expandproperty targetobject
    $createdUser = try{get-scsmobject -id $createdUserRelObject.Id -computername $environment} catch{}
    $assigneduser = try{get-scsmobject -id $assignedUserRelObject.Id -computername $environment} catch{}
    $history = get-scsmobjecthistory -object $incident -computername $environment
    $history = $history.History
    
    #cycle through the history of the Incident
    foreach ($item in $history)
    {
        #the Username on the history item takes the form of "DOMAIN\USER"
        if (($item.UserName -ne ($createdUser.Domain + "\" + $createdUser.UserName)) -and ($item.UserName -ne ($assigneduser.Domain + "\" + $assigneduser.UserName)))
        {
            #someone modified the work item that wasn't the Created by User or the Assigned User
            $modifiedIncidents++
            break
        }
    }
}

Write-Output "Total Incidents modified: $modifiedIncidents"