Can you please help me to form the search query for below scenario
ticket Created Closed Tic1 Jan-15 Aug-15 Tic2 Jan-15 Feb-15 Tic3 Feb-15 Mar-15 Tic4 Feb-15 Apr-15 Tic5 Feb-15 Mar-15 Tic6 Feb-15 Feb-15 Tic7 Mar-15 Mar-15 Tic8 Mar-15 Apr-15 ...... ..... .... ...
Month OpenTic Jan-15 2 Feb-15 4 Mar-15 3 ... ... ...
jan-15 = 2 tics opened not closed so open tic is 2 jan open tic count Feb-15 = 4 tics opened , 1 is closed (4-1)= 3 tic is open and From jan 1 tic still open, so 3+1 =4 open tic is in open so (feb tic3,tic4,tic5) 3+ (jan Tic1) 1 = 4 feb open tic count Mar-15 = 2 tics open , 1 is closed (2-1)= 1 is open and from jan 1 tic is still open , Feb 1 tic is still open so (Mar Tic8 )1+(jan Tic1)1+(feb Tic4)1= 3 mar open tic count
If I have this, I would do something like:
| eval ifClosed=if('Closed'="*", "yes","no") | stats count(eval(ifClose,"yes")) as closed_tickets | eval result=OpenTic-closed_tickets | timechart span=1mon result
I'm not sure about which indexes you have, but you should include both parts, the information of closed ticket(index 1) and the one for open tickets (index 2),
index=1 OR index=2, and then the other thing.
Let me know if it doesn't work! I will try again.
You need the
Probably like this (untested: may need to use
%e instead of
... | eval Created_epoch=strptime(Created, "%b-%d) | eval Closed_epoch=strptime(Closed, "%b-%d) | duration = coalesce(Closed_epoch, 99999999999999999) - Created_epoch | concurrency start=Created_epoch duration=duration | stats max(concurrency) AS OpenTic BY Created | rename Created AS Month