How to display data?

[nicksrulz]

Hi Experts,

Need help in displaying data , Currently i am able to display search data as

Status Date                   Date & Time              REASON_CODE
FAILED 25/04/2023 25/04/2023 20:33 Z910
FAILED 25/04/2023 25/04/2023 20:11 Z910
FAILED 25/04/2023 25/04/2023 3:38 Z911
FAILED 25/04/2023 25/04/2023 3:37 Z911
FAILED 25/04/2023 25/04/2023 3:37 Z911
FAILED 25/04/2023 25/04/2023 3:36 Z911

using below query :
============================================
index=test sourcetype="*" STATUS_REASON_CODE IN (U220, U902, U904, U905, Z704, Z900, Z902, Z903, Z904, Z910, Z911, Z912, Z913, Z914, Z920, Z922, Z923, Z924) STATE = FAILED | fields STATE _time STATUS_REASON_CODE | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) AS Time | convert timeformat="%Y-%m-%d" ctime(_time) AS TimeDay | eval FailTime=case(field_name="Failure Time", _time) | eval ReasonCode=case(field_name="Reason Code", STATUS_REASON_CODE) | eval State=case(field_name="State", STATE) | eval minTime = (min(Time)) | rename STATUS_REASON_CODE as REASON_CODE | sort - Time | table STATE TimeDay minTime REASON_CODE
==================================================

Need help in displaying data as :

Status    Date                     Start Time                  End Time                    REASON_CODE Count
FAILED   25/04/2023   25/04/2023 20:11 25/04/2023 20:33    Z910                  2
FAILED   25/04/2023   25/04/2023 3:36    25/04/2023 3:38      Z911                   4

Please help in modifying my query.

[livehybrid]

Instead of the | table command you might find something like this gives you what you need:

| stats count as ReasonCount, min(_time) as startTime, max(_time) AS endTime by REASON_CODE