https://community.splunk.com/t5/Splunk-Search/Mean-Time-To-Triage/m-p/569021#M198327 <P>Yes, - the join is doing calculations with time taken from the lookup for each rule_id. It appears to be calculating review times based on those items found in the 14 day search and then looking for amount of time taken to review (ttt=review_time-_time).</P><P>It would seem that is the intention of the search, that you will see data going back more than the search window, as it appears that it is looking for activity in the last 14 days and then trying to find data about how long the incident has taken to review, which of course will have to look back to when the rule was originally triggered.</P><P>So, is there actually a problem?</P><P>&nbsp;</P> Wed, 29 Sep 2021 22:10:40 GMT bowesmana 2021-09-29T22:10:40Z https://community.splunk.com/t5/Splunk-Search/Mean-Time-To-Triage/m-p/568484#M198119 <P>i have this spl&nbsp;</P><P>| tstats `summariesonly` earliest(_time) as _time from datamodel=Incident_Management.Notable_Events_Meta by source,Notable_Events_Meta.rule_id | `drop_dm_object_name("Notable_Events_Meta")` | `get_correlations` | join rule_id [| from inputlookup:incident_review_lookup | eval _time=time | stats earliest(_time) as review_time by rule_id] | eval ttt=review_time-_time | stats count,avg(ttt) as avg_ttt,max(ttt) as max_ttt by rule_name | sort - avg_ttt | `uptime2string(avg_ttt, avg_ttt)` | `uptime2string(max_ttt, max_ttt)` | rename *_ttt* as *(time_to_triage)* | fields - *_dec</P><P>it should display the mean time to triage for 14 days but it doesn't work for 14 days and works for 30 days.</P><P>any advise ?</P> Sun, 26 Sep 2021 13:50:58 GMT https://community.splunk.com/t5/Splunk-Search/Mean-Time-To-Triage/m-p/568484#M198119 ymalm188 2021-09-26T13:50:58Z https://community.splunk.com/t5/Splunk-Search/Mean-Time-To-Triage/m-p/568501#M198125 <P>What is the time window of your search?</P> Mon, 27 Sep 2021 00:48:51 GMT https://community.splunk.com/t5/Splunk-Search/Mean-Time-To-Triage/m-p/568501#M198125 bowesmana 2021-09-27T00:48:51Z https://community.splunk.com/t5/Splunk-Search/Mean-Time-To-Triage/m-p/568876#M198276 <P>14 days</P> Wed, 29 Sep 2021 06:07:24 GMT https://community.splunk.com/t5/Splunk-Search/Mean-Time-To-Triage/m-p/568876#M198276 ymalm188 2021-09-29T06:07:24Z https://community.splunk.com/t5/Splunk-Search/Mean-Time-To-Triage/m-p/568893#M198283 <P>The query seems to be getting time in the join statements. If you run just this part of the query - what time range of data do you get back?</P><LI-CODE lang="markup">| tstats `summariesonly` earliest(_time) as _time from datamodel=Incident_Management.Notable_Events_Meta by source,Notable_Events_Meta.rule_id | `drop_dm_object_name("Notable_Events_Meta")` | `get_correlations`</LI-CODE> Wed, 29 Sep 2021 07:57:47 GMT https://community.splunk.com/t5/Splunk-Search/Mean-Time-To-Triage/m-p/568893#M198283 bowesmana 2021-09-29T07:57:47Z https://community.splunk.com/t5/Splunk-Search/Mean-Time-To-Triage/m-p/568918#M198291 <P>it returned data for any time range i specify, especially 14 days that's what i want it returned data too so i think the problem with joining.</P> Wed, 29 Sep 2021 12:19:10 GMT https://community.splunk.com/t5/Splunk-Search/Mean-Time-To-Triage/m-p/568918#M198291 ymalm188 2021-09-29T12:19:10Z https://community.splunk.com/t5/Splunk-Search/Mean-Time-To-Triage/m-p/569021#M198327 <P>Yes, - the join is doing calculations with time taken from the lookup for each rule_id. It appears to be calculating review times based on those items found in the 14 day search and then looking for amount of time taken to review (ttt=review_time-_time).</P><P>It would seem that is the intention of the search, that you will see data going back more than the search window, as it appears that it is looking for activity in the last 14 days and then trying to find data about how long the incident has taken to review, which of course will have to look back to when the rule was originally triggered.</P><P>So, is there actually a problem?</P><P>&nbsp;</P> Wed, 29 Sep 2021 22:10:40 GMT https://community.splunk.com/t5/Splunk-Search/Mean-Time-To-Triage/m-p/569021#M198327 bowesmana 2021-09-29T22:10:40Z https://community.splunk.com/t5/Splunk-Search/Mean-Time-To-Triage/m-p/569470#M198480 <P>yes, your description is totally right so why i can't find any results for the last 14 days although there are actual data in these 14 days ? it was working before and suddenly stopped working.</P> Sun, 03 Oct 2021 08:43:43 GMT https://community.splunk.com/t5/Splunk-Search/Mean-Time-To-Triage/m-p/569470#M198480 ymalm188 2021-10-03T08:43:43Z https://community.splunk.com/t5/Splunk-Search/Mean-Time-To-Triage/m-p/569622#M198532 <P>So, if I understand you correctly, you get results from the first part of the search over 14 days without the join, but you are now saying that the full search over 14 days returns no resuts?</P><P>The search is 3 parts</P><OL><LI>The base tstats from datamodel</LI><LI>The join statement</LI><LI>Aggregations based on information from 1 and 2</LI></OL><P>So, run the second part of the search</P><LI-CODE lang="markup">| from inputlookup:incident_review_lookup | eval _time=time | stats earliest(_time) as review_time by rule_id</LI-CODE><P>Then if that gives you data and you KNOW that there is a rule_id that is common to both parts 1 and 2, then it is the 3rd part of the search that is does not have the right fields available.</P><P>The way for you to diagnose this is to gradually build up the search, adding each PIPE section to the search to understand what is causing the data to disappear.</P> Mon, 04 Oct 2021 22:46:43 GMT https://community.splunk.com/t5/Splunk-Search/Mean-Time-To-Triage/m-p/569622#M198532 bowesmana 2021-10-04T22:46:43Z https://community.splunk.com/t5/Splunk-Search/Mean-Time-To-Triage/m-p/569876#M198626 <P>when i run the first part i got result and also for the second part but when i run them together i got no data</P><P>like that:</P><P>&nbsp;</P><P>| tstats `summariesonly` earliest(_time) as _time from datamodel=Incident_Management.Notable_Events_Meta by source,Notable_Events_Meta.rule_id | `drop_dm_object_name("Notable_Events_Meta")` | `get_correlations` | join rule_id [| from inputlookup:incident_review_lookup | eval _time=time]</P><P>&nbsp;</P><P>i think there is a problem in the join&nbsp;</P> Wed, 06 Oct 2021 12:59:56 GMT https://community.splunk.com/t5/Splunk-Search/Mean-Time-To-Triage/m-p/569876#M198626 ymalm188 2021-10-06T12:59:56Z https://community.splunk.com/t5/Splunk-Search/Mean-Time-To-Triage/m-p/569960#M198664 <P>So if part 1 and part 2 are successful in their own right, then the issue is either</P><OL><LI>the field rule_id is not in the first data set</LI><LI>the field rule_id is not in the incident_review_lookup lookup</LI><LI>there are no common instances of rule_id in both data sets</LI></OL><P>&nbsp;</P> Wed, 06 Oct 2021 21:21:20 GMT https://community.splunk.com/t5/Splunk-Search/Mean-Time-To-Triage/m-p/569960#M198664 bowesmana 2021-10-06T21:21:20Z