I am having problems calculating an average time span. I need to determine how log it takes for a technician to "acknowledge" a ticket when it is created by the Help Desk.
source="servername" Assignee="*" GroupName="TierII" OR GroupName="TierIII"
| stats min(DateTimeAssign) AS begin max(DateTimeAcknow) AS end by CallID,GroupName,Assignee,Priority
| eval duration=round(end-begin) | eval hours=duration/3600 | eval minutes=round(duration/60)
| eval Created=strftime(begin," %b %d, %Y %T %p")
| eval Closed=strftime(end," %b %d, %Y %T %p")
| chart avg(hours) values(CallID) values(Created) as Assigned values(Closed) as Ack values(minutes) over GroupName
Try this
source="servername" Assignee="*" GroupName="TierII" OR GroupName="TierIII"
| stats min(DateTimeAssign) AS begin max(DateTimeAcknow) AS end by CallID,GroupName,Assignee,Priority
| eval duration=round(end-begin)
| eval Created=strftime(begin," %b %d, %Y %T %p")
| eval Closed=strftime(end," %b %d, %Y %T %p")
| stats avg(duration) as avgDuration values(CallID) values(Created) as Assigned values(Closed) as Ack by GroupName
| fieldformat avgDuration = tostring(avgDuration,"duration")