This may not be an exact fit but might get you on the way
|`incident_review` | rename status_label as status |stats values(rule_name), values(status), values(_time) by rule_id |rename values(_time) AS time
This would group the rule_id which is the key piece of grouping a notable event, bringing along the name of the correlation search and then grouping the status and pulling in the time for each status being reached.
This would only cover events that have changed status from unassigned because they are pulling from the audit index to get the changes in review state.
index=_audit sourcetype="incident_review"
To get all of the other notable events that are unassigned, you could do something like this:
|`es_notable_events` |where status = 1 |table rule_name, status_group, _time |`hourDiff(_time)`
This would give you all notable events that are in unassigned status and output the rule name, the time the event occurred and if you wanted to look at how many hours it has been while it is still unassigned you could use the macro hourDiff.
From there, you could do these as sub searches and use appendcols to pull it together.
This probably doesn't fully answer your question in the exact format you want but hopefully it is a step in the right direction.
BTW, incident_review and es_notable_events are macros. For some reason, it does not want to render correctly.
Thanks
john
