How to generate searches for the SLA Matrix feature for an alert, alarm, or incident?

[danda]

Can anyone quick help me with a query
1. where I can get the SLA for incident triggered time and incident acknowledge time SLA matrix?
2. Incident acknowledge time and incident escalate to next level or close time SLA? Basically calculate the time difference for the status change.

Request you to guide me on this. It would be very much helpful.

Regards,
Anil

[AndySplunks]

If you're using Enterprise Security, here is a search for SLA for closing a notable event:

`notable` 
      | search NOT `suppression` info_search_time=* 
      (urgency=low OR urgency=medium OR urgency=high OR urgency=critical) 
      | eval review_time=coalesce(review_time, now())
      | eval response_time=(review_time-info_search_time)/60/60 
      | eval metric_count=case(status_group==”Open”,”0”,(urgency=="critical" AND response_time<8),"1",(urgency=="high" AND response_time<24),"1",
      (urgency=="medium" AND response_time<48),"1",(urgency=="low" AND response_time<96),"1",1=1,"0") 
      | stats count sum(metric_count) as metric_met by urgency 
      | eval "SLA Compliance Percent" =round((metric_met*100/count),2) 
      | rename count as "Total Events", urgency as Urgency 
      | fields Urgency, "Total Events", "SLA Compliance Percent"

[aaraneta_splunk]

@danda - Your question is quite vague. And without any sample data, it would be difficult for the Answers community to offer you help with your searches. If you leave a comment with more information and sample data, please make sure the data is scrubbed/anonymized to protect any sensitive information.

In general, your question has a greater chance of being answered by experts in the Answers community when when you provide as much information and context as possible. Thanks.