Requirement- i am trying to create a report based on State of Incident( ticket). looking for latest State of ticket below is the my search query. if time range is selected more then "Today". results showing the previous Ticket State as well. ex Tkt123 current State is Resolved , prior to resolved State it was "IN PROGRESS". expected result should show current State of Tkt123 .
In below query i am looking for "IN PROGRESS" ticket State in Q_name=IT . but it is showing Tkt123 as well. when checked Tkt123 in SNOW tool it is resolved status
index=SNOW source=SNOW_source Q_name=IT |stats latest(State) AS State BY Number Last_Updated | stats dc(Number) AS Total |search State="IN PROGRESS" |appendpipe [stats count| eval Total="NODATA" |where count==0|table Total]