Example: a series of events all have the same incident number (1170820) outlining the lifecycle of the ticket (from open to close).
I want to be able to create a field for when the incident was closed so that the time can be easily identified on a dashboard. (Time | Closed Time | Computer Name | ETC).
How can I isolate a sub-search to track the latest ticket in a series of incidents so that I can set a field for "Closed time"?
Is there anything in the event that indicates that the ticket has been closed? also, have you looked at the Transaction command?
Is there anything in the event that indicates that the ticket has been closed? also, have you looked at the Transaction command?
Also, for the Open-Close state, I used an eval + convert to reformat the seconds format it spits out:
| eval Incident_Opened=_time, Incident_Closed=_time + duration
| convert timeformat="%m-%d-%Y %l:%M:%S %p" ctime(Incident_Opened), ctime(Incident_Closed)
Took a bit of research and testing but transactions turned out to be what I needed.
Ended up settling on:
| transaction incident_number, query with mvlist=t