Thanks in advance for any answers. So I have three fields; ticketNumber , group and TimeBlock Every ticketNumber has a group it is assigned to and a TimeBlock that it falls into for example; Ticket02 with group IT2 and assigned within 1Hour. I want to first groups the Tickets with their groups, and then chart the groups against the TimeBlocks So the x axis would be 1Hour 2Hour 3Hour etc and they would have the groups and when hovered over it displays the amount of tickets. ... View more

I have a number of tickets with TicketState : New, In Progress, Closed and Resolved depending on the tickets current state. They also have a short descriptor that involves a short summary of the problem as well as an identifier eg XX23XX2 What im doing is checking if the identifier in ShortDescriptor changes during the life span of the ticket, eg: If the ticket came into state New with a descriptor of XX2X , did the ticket get Resolved with the same descriptor. I use eventstats to find the earliest ShortDescriptor and latest ShortDescriptor and then compare them. I have this working and I was happy with it, however, I found a problem with the time range. If I have it set to 30 days, and some tickets were created more than 30 days ago with a different ShortDescriptor than it is 30 days ago, then my eventstats will only use the result from 30 days ago as opposed to its earliest value. Just wondering if there was a way to get all the tickets within 30 days, and if its earliest state is not New then it will search further back just for those tickets. Any help is appreciated, thanks. ... View more

So I have events that are tickets that have a State eg. "New" , "In Progress" , "Completed" etc and a short_description field with its value being a descriptor, as well as a unique number to differentiate between the tickets such as NO232 . What Im trying to do is iterate through all the tickets and find out when short description changes from one value to another and in which state it was in. I currently use streamstats which I believed worked well until I realised that it wasn't doing what I thought it was doing. | base search getting the tickets I want to focus on ... | streamstats current=true last(short_description) AS old_description, first(short_description) AS new_description BY number | search old_description!="*#*" AND new_description ="*#*")) | sorting and adding results to table... What I expected this to do was search the last event of the ticket, which was when its state was New, and see if its description did not include a # , and then check to see if the tickets description was updated anywhere in the lifespan to include a #. What I believe it is doing is just comparing the latest state and the previous state, for example comparing Closed and In Progress instead of New -> Closed. Any help is appreciated. ... View more

So I have a set of data with fields such as TimeCreated and TimeAssigned , which after some calculations I am left with the data and a new field which is the time taken to be assigned. I want to group the data into time blocks, such as amount of events assigned within 30 minutes, 1 hour etc... Not specifically 30 minute intervals though. I have no problem getting the first block, but how would I search the first results again in order to filter them into another time block. Any Help is appreciated, thanks. Edit: An example of what Im doing Each event is a ticket that has a field called TimeCreated, that is the time the ticket was created by the system, and a field called TimeAssigned, the time it was assigned to a user. | eval itime=strptime(TimeCreated,"%Y-%m-%d %H:%M:%S") | eval otime=strptime(TimeAssigned,"%Y-%m-%d %H:%M:%S") | eval TimeDiff=(otime-itime) | eval field_in_hhmmss=tostring(TimeDiff, "duration") This is what I have to find the difference between them, and it works perfectly but what I am looking for is how to filter the results of this search and get,for example, the total tickets assigned before 45minutes, between 1 and 2 hours etc. ... View more