The incident metric table (incident_metric) is not capturing the results of the field 'Updated by' (sys_updated_by) correctly

ALL

Metrics only work on audited fields. Creating a metric for a non-audited field produces unreliable metrics.

As per the documentation Create a metric, metrics only work on audited fields. Creating a metric for non-audited field produces unreliable metrics.

The sys_updated_by field is not audited as per the documentation Auditing. Hence metric definitions that use the sys_updated_by field do not work properly and produces unreliable metrics.

Please find the below section from documentation Create a metric where it says for the field column :

        Select the table column you want to monitor for changes. Metrics only work on audited fields. Creating a metric for non-audited field produces unreliable metrics.


Please follow the below section from documentation Auditing regarding system fields :

                    Information exempted from auditing...

                    ...Any field that begins with the sys_ prefix (system fields) except the sys_class_name and sys_domain_id columns...