About tjryberg

tjryberg · ‎08-18-2016

The above returned no results. Removed "arch" and got back 584.

tjryberg · ‎08-18-2016

I did run index=_internal latest=-30d | head 1 by itself. I should've mentioned that. index=gioanalytics_na source="dbmon-tail://MetricsITSR/ITSRC_METRICS" latest=-30d Returned 300,000+ events, so yes... stuff is there 🙂 index=gioanalytics_na source="dbmon-tail://MetricsITSR/ITSRC_METRICS" latest=[search index=gioanalytics_na source="dbmon-tail://MetricsITSR/ITSRC_METRICS" | eval search=(strptime(submit_dttm,"%m/%d/%y")-(86400*30)) | fields search] This returned the error: Error in 'search' command: Unable to parse the search: Comparator '=' has an invalid term on the right hand side. I tried playing around with it, but the error persists.

tjryberg · ‎08-18-2016

..... summary="*Decommission*" index=_internal latest=-30d | head 1 | chart count as Open-Decoms by assignee_support_group_name Doesn't return anything

tjryberg · ‎08-18-2016

So I'm trying this a different way. This search gets results: index=gioanalytics_na source="dbmon-tail://MetricsITSR/ITSRC_METRICS" | dedup request_id | search assignee_support_group_name="usa.nss.x2aix*" OR assignee_support_group_name="usa.nss.x2linux*" OR assignee_support_group_name="usa.nss.x2sun" OR assignee_support_group_name="usa.nss.x2Windows" OR assignee_support_group_name="usa.dis.dsaix" OR assignee_support_group_name="usa.dis.dslinux" OR assignee_support_group_name="usa.dis.dssun" OR assignee_support_group_name="usa.dis.dswin" status_desc=Open OR status_desc=Assigned summary="*Decommission*" | chart count as Open-Decoms by assignee_support_group_name When I add latest=-30d , nothing returns. I've manually looked and verified that we have tickets out there, older than 30 days. Any idea why I'm getting nothing back?

tjryberg · ‎08-01-2016

I played with some things, over the weekend. Still no luck.

tjryberg · ‎07-29-2016

Yup, I did catch that 🙂 No Luck

tjryberg · ‎07-29-2016

No luck. Still zero results returned.

tjryberg · ‎07-29-2016

Howdy Folks, Going through the support forums, I've tried numerous ways to come up with a way to search for Open ticket IDs, older than X (30, 60, 90, etc.) days. While playing around with my query, I either get all the tickets returned, or none of them. I'm basing the "day" mark from the time the ticket was submitted (submit_dttm). index=[index name] source="dbmon-tail://MetricsITSR/ITSRC_METRICS" | dedup request_id | search assignee_support_group_name="USA.NSS.X2AIX" assignee="*" status_desc="In Progress" OR status_desc="Assigned" | eval submitdate=strptime(submit_dttm,"%m/%d/%y") |where now()<relative_time(submidate, "+30d") | table assignee submitdate request_id My expectation of the above, is a table with the person's name, the date the ticket was submitted, and the ticket #

Posts	8
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎07-29-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Ticket IDs older than 30+ days

Re: Ticket IDs older than 30+ days

Re: Ticket IDs older than 30+ days

Re: Ticket IDs older than 30+ days

Re: Ticket IDs older than 30+ days

Re: Ticket IDs older than 30+ days

Re: Ticket IDs older than 30+ days

Re: Ticket IDs older than 30+ days

Ticket IDs older than 30+ days

Join the Conversation