I have data coming from an Avaya phone system that provides me the end time of the event and the duration, I am creating a start_time field based on those fields. I get a table with the trunk number, start time, duration, and end time. I am trying to get trunk capacity, so I need to know how many events are listed as occurring between the start time and end time. index="voice_switch"
| eval Trunk = mvappend(Incoming_Trunk_Group, Outgoing_Trunk_Group)
| eval Dur = (DurH * 60 *60) + (DurM*60) + (DurTenths *6) | eval Start_Time = _time - Dur
| eval Duration = tostring(Dur, "duration")
| convert ctime(Start_Time)
| convert ctime(_time)
| rename _time as End_Time
| table Trunk,Start_Time, Duration,End_Time Trunk Start_Time Duration End_Time 8940 10/13/2020 07:59:58 00:23:48 10/13/2020 08:23:46 8940 10/13/2020 08:02:41 00:26:06 10/13/2020 08:28:47 8905 10/13/2020 08:05:57 00:16:54 10/13/2020 08:22:51 8940 10/13/2020 08:08:14 00:14:00 10/13/2020 08:22:14 8940 10/13/2020 08:08:18 00:14:36 10/13/2020 08:22:54 8905 10/13/2020 08:08:53 00:13:00 10/13/2020 08:21:53 8940 10/13/2020 08:09:37 00:26:18 10/13/2020 08:35:55 8940 10/13/2020 08:11:01 00:12:30 10/13/2020 08:23:31 8901 10/13/2020 08:11:22 00:11:18 10/13/2020 08:22:40 8940 10/13/2020 08:11:37 00:11:36 10/13/2020 08:23:13
... View more