Streamstats Time Sum When Specific Values

[mikepangrac]

Hi All,

I'm stumped on the following search. The scenario is I'm trying to track the amount of time a support ticket is assigned to a support team and specific status, for the lifecycle of the ticket. The following |streamstats works great, assuming the ticket doesn't get assigned to the same team and status twice. (getting assigned out and back in) It currently sums the time between. Again, I only want to sum the time in a team and status, not including the time between where it goes out.

|dedup ticket_id,_time,ticket_arvig_status
|eval temp2=id+","+ticket_status
|search (ticket_team="TIER 2" AND ticket_status="tier 2 needed"
|streamstats range(_time) AS StatusDuration by ticket_id global=f window=2
|stats sum(StatusDuration) AS TotalStatusDuration by ticket_id, ticket_status, ticket_team
|stats avg(TotalStatusDuration) as averageage by ticket_id

Any help would be appreciated!

[to4kawa]

I'm not sure not including the time between where it goes out.
TotalStatusDuration ?

[adonio]

you cant range _time by ticket_id because you already deduped the ticket_id ...
meaning, you have only a single event (and therefore a single _time) for each ticket_id
can you share sample data and desired results?