How to display pool down on two cluster server?

[elmadi_fares]

index=idx_rdap source="*f5*" "*member*" "RO1B4-0JLSM4000S" "/Common/pool_d2i_*gkrgkl"
| rex field=member "\/Common\/(?<server>[^:]*)"
| stats latest(status) as Last_status, values(pool), as pool_name, values(_time) as _time by pool, server
| stats values(Last_status) as Last_status, values(server) as server by pool
| eval severity=case(server="XC001X02" AND server="XC001X03" AND Last_status="down", "1", server="XC001X03" AND Last_status="down", "3", server="XC001X02" AND Last_status="down", "3",true(),"0" )
| table pool, Last_status, severity, server
| eval hour_of_the_starttime=strftime(_time, "%H")
| eval support_group=if(hour_of_the_starttime>=19 OR hour_of_the_starttime<7,"WW-XX-TFORMEGI-L3", "WW-XX-MSEGI-L2")
| eval ressource="GKR-GkL-I:" + pool
| eval service_offring="GKR-GkL-I"
| eval description="VIP GMS got a service status down \n \nDetail : One or more legs Impacted service on :" + pool + "\n On server(s): " + tostring(server) + " \n\n\n\n; " + support_group + " ;KB=KB00000"
| table ressource description pool service_offring severity server support_group

[elmadi_fares]

someone can you help me ???

[elmadi_fares]

I need to have a condition to assign a snow incident to two different groups according to the time slot in working and non-working hours

[richgalloway]

Please edit your post to put the question in the body rather than the subject.  As it is now, the question is truncated so we don't know what the problem is.