Problem I want to be able to create a timechart that outlines the company's incident count by week. The issue I have is many incidents are created in one week but then resolved in the following week. That final event is then shown in the following weeks figures. The way I have gotten around this before when searching a specific timeframe is by creating a start & end timestamp and having the Dates_Created field fall between the two times. However I am unsure how to use this in a week by week case. Example: | eval startstamp=strftime(relative_time(now(),"-mon@mon"),"%Y-%m-%d %H:%M:%S") | eval endstamp=strftime(relative_time(now(), "-1s"),"%Y-%m-%d %H:%M:%S") | where Dates_Created >= startstamp AND Dates_Created < endstamp Query This query currently shows me all events that have occurred on a week by week basis. However I want it to shows all tickets that were created (Dates_Created) on a week by week basis. | index="Respond" sourcetype=Ticket queue="Incident" earliest=-42d@d latest=now | dedup ticket | eval week_month=strftime(_time, "%V") | bucket span=7d _time | chart count by week_month Any help will be greatly appreciated ... View more

Background So I have two date fields - Date_Created & Acknowledge_Date both in the format YYYY-MM-DD HH:MM:SS . I wish to work out the difference of these two times and then create an average of all the results - essentially this -> Average(Acknowledge_Date-Date_Created) Search I have created the following search. This has converted the times to epoch, subtracted them, and provided an average of the epoch time. index="Cyber" sourcetype=Response queue = "Incident" status ="resolved" | dedup ticket | table Date_Created, Acknowledge_Date | eval epoch1=strptime(Date_Created,"%Y-%m-%d %H:%M:%S") | convert timeformat="%Y-%m-%d %H:%M:%S" mktime(Date_Created) as epochDateCreated | eval epoch2=strptime(Acknowledge_Date,"%Y-%m-%d %H:%M:%S") | convert timeformat="%Y-%m-%d %H:%M:%S" mktime(Acknowledge_Date) as epochAck | eval Diff=(epochAck-epochDateCreated) |stats avg(Diff) Problem I now have an average number in epoch format - 5848.333333 - is there a way to convert this into HH:MM:SS Any help will be much appreciated ... View more