Hello ,
I have a question (or a problem) about my code:
|loadjob savedsearch="a468413:ied:req_test2"
|eval time = strftime(_time,"%m/%d/%Y %I:%M %p")
|eval D1=if(MESSAGE="Connexion genesys OK + agent joint",strptime(time, "%m/%d/%Y %I:%M %p") ,NULL)
|eval D2=if(MESSAGE="Proposition du questionnaire de satisfaction client",strptime(time, "%m/%d/%Y %I:%M %p") ,NULL)
|eval diff=D2-D1
|where chatId="0007SaDCMCP301EX" AND (match(MESSAGE,"(\s|^)Replique(\s|$)") OR match(MESSAGE,"(\s|^)replique(\s|$)") OR MESSAGE="Proposition du questionnaire de satisfaction client" OR MESSAGE="Connexion genesys OK + agent joint") AND MESSAGE!="Le chat va etre cloture car le timeout de non replique client et conseiller a ete atteint"
|table _time,chatId,D1,D2
|sort _time asc
The reslt that i want,is to have a table with one line with colums (chatId,D1,D2 AND diff),so here i have two problems,i have three D1(i want to take just the fist one),the second problem is that i have a lot of lines of one chatID
... View more