SubSearch - Selecting the last mention of an incident number

[ervinsmith]

Example: a series of events all have the same incident number (1170820) outlining the lifecycle of the ticket (from open to close).

I want to be able to create a field for when the incident was closed so that the time can be easily identified on a dashboard.  (Time | Closed Time | Computer Name | ETC).

How can I isolate a sub-search to track the latest ticket in a series of incidents so that I can set a field for "Closed time"?

 

[sharynh · Accepted solution]

Is there anything in the event that indicates that the ticket has been closed? also, have you looked at the Transaction command? 

[ervinsmith]

Also, for the Open-Close state, I used an eval + convert to reformat the seconds format it spits out:

| eval Incident_Opened=_time, Incident_Closed=_time + duration
| convert timeformat="%m-%d-%Y %l:%M:%S %p" ctime(Incident_Opened), ctime(Incident_Closed)

[ervinsmith]

Took a bit of research and testing but transactions turned out to be what I needed.

Ended up settling on:

| transaction incident_number, query with mvlist=t