I would like a search query that would display a graph with the number of closed notables divided by urgency in the last 12 hours, but the notables need to be retrieved based on the time they were cl...
See more...
I would like a search query that would display a graph with the number of closed notables divided by urgency in the last 12 hours, but the notables need to be retrieved based on the time they were closed. I'm using this search: | inputlookup append=T incident_review_lookup
| rename user as reviewer
| `get_realname(owner)`
| `get_realname(reviewer)`
| eval nullstatus=if(isnull(status),"true","false")
| `get_reviewstatuses`
| eval status=if((isnull(status) OR isnull(status_label)) AND nullstatus=="false",0,status)
| eval status_label=if(isnull(status_label) AND nullstatus=="false","Unassigned",status_label)
| eval status_description=if(isnull(status_description) AND nullstatus=="false","unknown",status_description)
| eval _time=time
| `uitime(time)`
| fields - nullstatus What's wrong?