index=oncall_prod originOnCall="Prod" incidentNumber=497764
| sort _time desc
| rex field=entityDisplayName "(?<Priorité>..) - (?<Titre>.*)"
| eval startAlert = if(alertType == "CRITICAL", _time, ""...
See more...
index=oncall_prod originOnCall="Prod" incidentNumber=497764
| sort _time desc
| rex field=entityDisplayName "(?<Priorité>..) - (?<Titre>.*)"
| eval startAlert = if(alertType == "CRITICAL", _time, "")
| eval startAlert = strftime(startAlert,"%Y-%m-%d %H:%M:%S ")
| eval ackAlert = if(alertType == "ACKNOWLEDGEMENT", _time, "")
| eval ackAlert = strftime(ackAlert,"%Y-%m-%d %H:%M:%S ")
| eval endAlert = if(alertType == "RECOVERY", _time, "")
| eval endAlert = strftime(endAlert,"%Y-%m-%d %H:%M:%S ")
| eventstats values(startAlert) as startAlert, values(ackAlert) as ackAlert, values(endAlert) as endAlert, values(ticket_EV) as ticket_EV by incidentNumber