Sorry, I used the wrong field name in the lat stats. The following should work! ....
| eval fallbacks=if(match(intent,"fallback"),1,0)
| eval agent_escalation=if(match(intent, "support.contact_agent"),1,0)
| eval fallback_timestamp=if(fallbacks=1,_time,null())
| eval agent_escalation_timestamp=if(agent_escalation=1,_time,null())
| stats min(fallback_timestamp) as earliest_fallback_timestamp max(agent_escalation_timestamp) as latest_escalation_timestamp max(fallbacks) as had_a_fallback, max(agent_escalation) as had_an_escalation by sessionId
| eval time_diff=latest_escalation_timestamp-earliest_fallback_timestamp
| eval escalated_after_fallback=if(time_diff>0,1,0)
| stats sum(had_a_fallback) as total_fallback_sessions, sum(escalated_after_fallback) as total_escalated_sessions_after_a_fallback sum(had_an_escalation) as total_escalated_sessions
| eval Fallback_escalation_rate=round(total_fallback_sessions/total_escalated_sessions*100, 1)
... View more