RT Request Tracker Hints and Examples

Software at https://rt.uwaterloo.ca/ is often referred to as Request Tracker -- that is the name used at https://bestpractical.com. But the term "Request Tracking" has also been used in the past, especially in this TWiki.

I hear lots of people complain that RT is difficult to search. But I find it reasonably straight-forward, so I'm going to try to put some hints here.

• Perhaps an important point is that I rarely used the old ST run-on-sentence

Other sources of Best Practical Request Tracker (RT) documentation

SimpleSearch

• https://rt-wiki.bestpractical.com/wiki/
  • https://rt-wiki.bestpractical.com/wiki/ManualSimpleSearch

And also the apparent documentation relevant to the current (Oct 2020) version of the https://rt.uwaterloo.ca/ software

• https://docs.bestpractical.com/rt/4.4.4/full_text_indexing.html

And other RT TWiki Pages

• STToRTDocumentation
  • TicketSQL
• STToRTInvestigation
  • STToRTInvestigationChangeRequests
  • STToRTInvestigationFactors
    • STToRTInvestigationFactorsAssessment
    • STToRTInvestigationFactorsSorting20160602
  • STToRTInvestigationTechnical20170123
  • STToRTInvestigationTechnical20170308
  • STToRTInvestigationFields
    • STToRTInvestigationStaffMeetingPresentation20170216
    • STToRTInvestigationStaffMeetingPresentation20170324
  • STToRTInvestigationISTTraining20170412
    • IST RT docs
      • IST RT4 docs
      • Confluence Wiki RT documentation
      • Issue Solver Advanced (caution: numerical pageid= may indicate transience)
  • STToRTBestPracticalTraining20170118-19 (not really end-user documentation)
• STToRTRequestsAndIssues

Getting your teeth into a search

AdrianPepper 's personal normal starting search

My personal standard search for myself is...

• Show all open items 'Adrian Pepper" is watching, ordered by last acted
  • The query URL is immensely long; but you can copy it if you're careful
  • The query is personalized for me, by using Watcher.id = 972 (also a spurious version which should match little)
    • but while composing this page, I learned about __CurrentUser__ so Show all open items __CurrentUser__ is watching, ordered by last acted (I worry that might not match any secondary email addresses)
  • Surely everyone has noticed you can sort on any field by clicking the field name at the top?
    • Clicking again reverses the order (this is fairly standard interface these days)
  • The query is somewhat odd, with features to take advantage of the RT "Edit Search" link
    • A lot of redundant almost no-op conditions create a template
      • This is useful when you want to add conditions, and then switch some "AND" section to "OR"
      • While composing this TWiki page, however, I realized that you can actually link to the Search Edit page itself
      • So, although I expect the redundant query conditions will be optimized to cause little expense, I will consider in future using more optimized searches for regular use, with a special link to a version amplified with template-like conditions
  • The query has another redundant (contradictory) Queue query merely to force the display of the sc_sponsor column
    • This also makes the CSCF custom fields appear when you "Edit Search"

Often I bring up this search, select Edit Search and away I go! (Note you will probably need to click okay to a cross-site forgery warning for that last link in this page, although when you use the link from your own search results, that should not happen).

• Suppose I want to instead search for Active items with Watcher whose email matches "brenna"
  • First I need to delete my two Watcher.id lines, then "add these terms" "Watcher.EmailAddress LIKE 'brenna'" resulting in This search (Show Results)
• Or perhaps simply add a search condition "Subject Like 'web'" to find my Active Watched items matching that

AdrianPepper 's wide-ranging date-based searches

• But I have another approach
  • RT Buzz Search (5 day version)
  • CSCF RT Buzz Search (5 day version)
  • Note that "N days ago" is somewhat tricky to enter in the "Edit Search" page. You need to carefully enter it in the date box, ignoring the calendar, and go down to select the "Add to search" button so as avoid it being converted to an absolute date.
  • You can screen search results in your browser
  • Or you can use "Edit Search" to refine the results

In fact I have convenient links for different numbers of days...

• As in
  • RT buzz search (3) (4) (5) (6) (7) (8) (9) (10) (20) (33) (66)
  • CSCF RT buzz search (3) (4) (5) (6) (7) (8) (9) (10) (20) (33) (66)

Searching for tricky matches

• You can select Edit Search (remember to accept cross-site forgery warning for that link in this page) and add Subject or Content searches.
  • An annoying feature is you cannot change a Subject search to a Content search, or vice-versa
    • You can do the change simply with "Advanced"
    • (Sticking to regular "Edit Search", you need to add the corrected version, then delete the one you no longer want, after all)
  • Obscure detail: if you cut-and-paste from this page, you get the wrong type of double-quote characters, and it does not work at all

• Realize that matching Content LIKE 'meeting -covid -pandemic' allows exclusion, matching something like items with "meeting" in Content, but not "covid" or "pandemic"
• You would think Content LIKE 'meeting-covid-pandemic' would match the same, but, in fact, it appears to match items with 'meeting' OR 'covid' OR 'pandemic
  • Something like "m3-3101-rt-san-100” (including the double-quotes) can be used to search for hyphens embedded in a string
    • Or it can be entered directly in the "normal" Search box as '"m3-3101-rt-san-100”' (including both outer single- and inner double-quotes)
    • '"129.97.167.114"' also works for an IP address (details later)
      • or '"2620:101:f000:4803::114"'
  • It actually would seem that, while 'meeting -pandemic' matches items containing "meeting" BUT NOT "pandemic", 'meeting-pandemic' matches items containing "meeting" OR "pandemic"
    • Perhaps 'meeting -cscf', 'meeting', 'cscf' and 'meeting-cscf' might give a better demonstration
      • so later I should document those results

Matching IP addresses

• People have reported an inability to match IP addresses (but, yes, you can)
  • Actually, in the "normal" Search box, '"129.97.167.114"' (with both inner and outer quotes, works as it does with hyphens
    • "Advanced" is a good way to check the generated SQL
  • Content searches make heavy use of string indexing, and you probably cannot match substrings of IP address components
    • '"129.97.167"' and '"129.97.167.114"' likely match overlapping strings * but '"129.97.167.11_"' or '"129.97.16_."' (almost certainly) do not work

Use "Advanced" to see what is really sent

• Note the "Advanced" link at the top of search results and/or "Edit Search" pages
• "Advanced" is a good way to check the generated SQL
  • You can edit the boxes, then the "Apply" button should send you back to "Edit Search" with the changes "applied"
  • If not, you should see a syntax error indicating a parsing problem

Content searches do have additional limitations (bugs?)

• Seems likely % and _ do not work in queries attempting to use "matches" (i.e. "LIKE") queries in the Content pseudo-column
• Content searches make heavy use of string indexing, and you appear not to be able to match substrings of indexed values
  • and so Content LIKE "meeting"
  • matches more items than does Content LIKE "meet"
  • Adding % does not change such results Content like 'meet%'
  • Empirically, a search of Content using "NOT LIKE" often, if not always, returns the same as the "LIKE" query (2020-10-05)
• Subject LIKE 'meet%' seems to work as you might expect (to avoid overloading the reader as well as the RT system, this search is constrained to a fixed Created date range)
  • so does the negation of its pattern match Subject NOT LIKE 'meet%'
  • a caveat is that Subject LIKE '"cs%"' actually matches the literal double-quotes, finding few matches (a wider date constraint was used, so the negation works, but returns over 10000 results)
    • compare with Subject LIKE 'cs%' which itself returns over 1300 tickets
      • between Jan 01, 2020 and Oct 01, 2020, same as Subject Like 'cs' (terminal wildcard is redundant)
  • so Subject LIKE 'meet' AND Subject NOT LIKE 'meet% ' tends to match items with Subject ending in 'meeting' (or 'meetings'), and at least on 2020-10-07 reveals one item subject ending in 'meetings' but followed by an "invisible" terminal blank

Private sections not intended for readers yet

Semi-speculative analysis (some hacking?)

• Realize that matching meeting-covid-pandemic allows exclusion, matching something like items with "meeting" in Content, but not "covid" or "pandemic"
• Might be more normally written as meeting -covid -pandemic with spaces (but that gets different results)
  • Something like "m3-3101-rt-san-100” (including the double-quotes) can be used to search for hyphens embedded in a string
    • Or it can be entered directly in the "normal" Search box as '"m3-3101-rt-san-100”' (including both inner and outer quotes)
  • An annoying feature is you cannot change a Subject search to a Content search, or vice-versa
    • (You need to add the corrected version, then delete the one you no longer want, after all)
      • You can do the change simply with "Advanced"
    • Obscure detail: if you cut-and-paste from this page, you get the wrong type of double-quote characters, and it does not work at all
  • the inability to match IP addresses
    • Actually, in the "normal" Search box, '"129.97.167.114"' (with both inner and outer quotes, works as it does with hyphens
      • "Advanced" is a good way to check the generated SQL
    • Also '"2620:101:f000:4803::114"'
  • RT documentation advertises special pattern characters "_" (any character) and "%" (zero or more occurrences of any character)
    • It's a good idea to add a "LastUpdated since" limit to such a general query
    • Might even be good to limit perpage to between 1000 and 2000
      • Results of Content searches using "_" or "%" sometimes appear to be inconsistent

• • Matching IP addresses can be accomplished by using "Advanced" to add double-quotes within the single quotes (More later)
    • Actually, in the "normal" Search box, '"129.97.167.114"' (with both inner and outer quotes, works as it does with hyphens

* Items mentioning both IPv4 and IPv6 address of ubuntu1804-102.cs.uwaterloo.ca.

o

Trying to determine how butnot works

* Content LIKE 'meeting' (147)

* Content LIKE covid (79)

* Content LIKE pandemic (30)

* Content LIKE meeting AND Content LIKE covid (7)

* Content LIKE meeting AND Content LIKE pandemic (4)

* Content LIKE meeting AND Content LIKE pandemic AND Content LIKE covid (2)

* Content LIKE meeting AND Content NOT LIKE covid AND Content NOT LIKE pandemic (2) ????

Moving to New Example meeting mfcf cscf

• Content LIKE 'meeting -cscf -mfcf' (413)

• Content LIKE 'meeting -cscf' AND Content LIKE 'meeting -mfcf' (413)

• Content LIKE 'meeting -mfcf' (457)

• Content LIKE 'meeting -cscf' (429)

• Content LIKE 'meeting' (475)

• Content LIKE 'cscf' (1,392)

• Content LIKE 'mfcf' (566)

• Content LIKE 'cscf' AND Content LIKE 'mfcf' (69)

• Content LIKE 'meeting' AND Content LIKE 'cscf' (79)

• Content LIKE 'meeting' AND Content NOT LIKE 'cscf' (79) (? BUG!)

• Content LIKE 'meeting' AND Content LIKE 'mfcf' (40)

• Content LIKE 'meeting' AND Content LIKE 'cscf' AND Content LIKE 'mfcf' (10)

• Content LIKE 'meeting-cscf-mfcf' (2179)

• Content LIKE 'meet' (177)

• Perusing some of the other documentation I have now cited caused me to realize that an additional problem can sometimes be that the number of items returned might be greater than the number of items you will be shown (because of permission restrictions)

-- Adrian Pepper - 2020-09-25

RTRequestTrackingTrackerHints