As to the missing results - sure, because your TOTAL field appears empty. You should just debug that for a start. All the extra conditional logic you want can be implemented later once you get this...
See more...
As to the missing results - sure, because your TOTAL field appears empty. You should just debug that for a start. All the extra conditional logic you want can be implemented later once you get this core piece working. Here's how I'd approach it: Temporarily comment out (triple backticks before and after them) or remove all the fieldformats and the trailing table command so you can see what values all fields actually have. When you put them back in, I suggest doing those "pretty it up" tasks as one of the last steps after all actual "work" has been done. Also this makes it easier to follow the code because it'll be structured better - first get your data, then do your calculations, lastly make things pretty. Then just backtrack. Divide and conquer. Remove all the stuff after the stats command where TOTAL is calculated. If there's no result for TOTAL, figure out why. Since TOTAL is the sum of time_difference, take out everything from the stats onward and see what time_difference is in the events. If it's blank, then work backwards one more step and see where it comes from - incident review time and notable time - so what are the values for *those* fields? At some point you'll see what I'm sure is a facepalm somewhere in there. Once you have all that straightened out, add back in the extra stuff one step at a time, confirming the results at each step. You'll have a lot better understanding of the data you are working with and also how all this works, too. THEN. There's likely to be no reason at all to separately do only "medium" severity. I suspect if you remove the "where" way up near the top, then do all your stats "by severity" you may be able to just calculate the answers for all severities in one pass. But again, baby steps. Get it working first, then we can modify it to do that.