Help creating a table that shows Incident Review Mean Time to Triage for each type of notable per notable owner

[LionWolf]

Hello,

This is my first time seeking help in a forum, I apologize if my ask is confusing.

I'm looking to pull the metrics for each analyst based on the Mean time to triage each type of notable in the Incident Review dashboard. I need a table that shows the time it took for each analyst to put the status in "Ready for Review" after they put the status as "In Progress, the analyst name, & the notable name

This is a similar search to the one I have right now:

|`incident_review`

| rename status_label as status

| where status == "Ready for Review"

| sort - _time

| table status,rule_id,rule_name,owner_realname

| rename rule_id as "Notable ID"

| rename rule_name as Notable

| rename owner_realname as Analyst

| join type=left rule_id [ search notable | rename _time as notable_creation_time | convert ctime(notable_creation_time) 

| stats min(notable_creation_time) as notable_creation_time by rule_id]

[LionWolf]

Hello ITWhisperer,

If I were to change the time format to resemble something like HH:MM:SS then I think I would use the covert ctime() function in the timetoprocess variable correct? Or since it is pulling data from the reviewtime and the inprogresstime variables, would I have to convert those times as well?

[ITWhisperer · Accepted solution]

You could try something like this

|`incident_review`
| rename status_label as status
| eval reviewtime=if(status="Ready for Review",_time,null())
| eval inprogresstime=if(status="In Progress",_time,null())
| stats min(reviewtime) as reviewtime min(inprogresstime) as inprogresstime values(rule_name) as rule_name values(owner_realname) as real_name by rule_id
| rename rule_id as "Notable ID"
| rename rule_name as Notable
| rename owner_realname as Analyst
| eval timetoprocess=reviewtime-inprogresstime
| eval timetoprocess=tostring(timetoprocess,"duration")

[LionWolf]

Hello ITWhisperer,

This table is amazing! Thank you so very much!