Hi Everyone,
I am trying to write a query that will allow me to use my notable_events table, display the time the notable opened and the time it was closed.
Looking through the forums I found:
|eval _time=strftime(_time,"%Y/%m/%d %T")
|eval review_time=strftime(review_time,"%Y/%m/%d %T")
|eval assign_time = case(isnotnull(owner), _time) | eval close_time = case(status=5, review_time)
|stats min(_time) as notable_time min(assign_time) as assign_time min(close_time) as close_time by AlertTitle,owner
But that isn't quite working as it returns 0 results.
