Hi @rnowitzki , Thanks for the replay, Its working as expected, but I would like include the not_completed count as well like as shown blow.  | eval status=case(SLA_start_datetime>curr_datetime, "NOT_STARTED", SLA_start_datetime<curr_datetime AND SLA_end_datetime<=curr_datetime OR not_completed!=0, "COMPLETED",SLA_start_datetime<=curr_datetime AND SLA_end_datetime>curr_datetime, "RUNNING")  above case also working as expected but where i am getting the problem is when the job is completed(SLE end time reached) at that time if not_completed count is not equal to 0 then Status should be "SLA Not Completed/Met" after some time(after sla end time) not_completed=0 its becoming "Completed" Working now: when the job is completed(SLA end time reached) at that time if not_completed count not equal to 0 then Status should be "SLA Not Completed/Met" Expected: when the job is completed(SLA end time reached) at that time if not_completed count not equal to 0 then Status should be "SLA Not Completed/Met"  after some time count is equal to 0 even though  Status should be "Not Completed/Met" for that day why because its SLA missed for that day with in sla allocated time. Please help on this, thanks in advance. ... View more

Hi @rnowitzki Now Iam able to get the data for sla start time and sla end time including date as well as shown below. DATE=2020-06-14 date_mday=14 date_month=06 date_year=2020 SLA_start_time=16:00 SLA_start_date= 061320 and SLA_end_time=17:00 SLA_end_date=061420(MMDDYY). Plz help me on this, Thanks in advance. ... View more

Hi @rnowitzki , Thanks for the quick replay, I have only these fields like DATE=2020-06-14 date_mday=14 date_month=06 date_year=2020 SLA_start_time=16:00 and SLA_end_time=17:00 in each event. but values are the different in each event 😜  can we include date or date_mday to get as we required like this?? | eval status=if(curr_date_hour>substr(SLA_start_time,1,2) AND curr_date_hour>=substr(SLA_end_time,1,2) AND SLA_start_time < SLA_end_time, "COMPLETED", if(curr_date_hour<substr(SLA_start_time,1,2) AND (current_day!=date_mday),"NOT_STARTED", if(curr_date_hour>=substr(SLA_start_time,1,2) AND (curr_date_hour<substr(SLA_end_time,1,2) OR SLA_start_time > SLA_end_time),"RUNNING", "ERROR_IN_STATUS_DETECTION"))) ... View more

Hi @rnowitzki Thnaks for the replay and info. I have used the same as you suggested but the result is not as expected,  | eval curr_date_hour = strftime(now(), "%H") | eval status=if(curr_date_hour>substr(SLA_start_time,1,2) AND curr_date_hour>=substr(SLA_end_time,1,2), "COMPLETED", if(curr_date_hour<substr(SLA_start_time,1,2),"NOT_STARTED", if(curr_date_hour>=substr(SLA_start_time,1,2) AND curr_date_hour<substr(SLA_end_time,1,2),"RUNNING", "ERROR_IN_STATUS_DETECTION"))) Output: :                           Here highlighted jobs are started at 6 pm, 8 pm, and 9 pm today and supposed to complete next day 01:00 am but still its showing completed, I was executed this search at 10 pm. please help on this same. I have day field as date_mday which stores day value like 14, So i alerted the query to compare current day  with date_mday as shown below but no luck. | eval curr_date_hour = strftime(now(), "%H") | eval curr_day = strftime(now(), "%d")  | eval status=if(curr_date_hour>substr(SLA_start_time,1,2) AND curr_date_hour>=substr(SLA_end_time,1,2), "COMPLETED", if(curr_date_hour<substr(SLA_start_time,1,2) AND (curr_day!=date_mday),"NOT_STARTED", if(curr_date_hour>=substr(SLA_start_time,1,2) AND curr_date_hour<substr(SLA_end_time,1,2),"RUNNING", "ERROR_IN_STATUS_DETECTION"))) I have a fields like DATE=2020-06-14 date_mday=14 date_month=06 date_year=2020 SLA_start_time and SLA_end_time. Please help me this and thanks in advance. ... View more

Hi @rnowitzki thanks for the replay, as I mentioned above few of jobs are starting end of today like 23:00 pm and completing next day early in the morning like 02:00 am. how can we solve this scenario, how the query will be if I use date and time(HH:MM) as you suggested. please help on this, Thanks in advance. ... View more

Hi @somesoni2 , I have few of errors like field name is errors, I would like to compare last 24 hours errors with last 60 days, if not matched, i need to display those errors. Please help on this. Thanks in advance. ... View more