About simon1524

simon1524 · ‎09-27-2022

Thank you very much! The result is showing now~

simon1524 · ‎09-27-2022

Thank you! Got the first step done by your query. | eval SUBMITED_DATE = split(SUBMITED_DATE, " ") | eval date = mvindex(SUBMITED_DATE, 0), time_of_day = strptime(mvindex(SUBMITED_DATE, 1), "%H:%M:%S") | eval shift = case(time_of_day < 1664258400, "A", 1664258400 <= time_of_day AND time_of_day < 1664287200, "B", true(), "C") The next step is to count the number of each month | timechart span = 1mon count(eval(shift = "A")) as first_shift, count(eval(shift = "B")) as second_shift, count(eval(shift = "C")) as third_shift | tail 12 | sort _time As you see my query, I want to count every shift in every month of the last year. But there is something wrong with above query...

simon1524 · ‎09-26-2022

According to the data on the system, it should be accurate to the second. | eval SUBMIT_DATE = split(SUBMIT_DATE, " ") | eval part1 = mvindex(SUBMIT_DATE, 0), part2 = mvindex(SUBMIT_DATE, 1) According to the function you give "00:00:00 > part2 >= 08:00:00" as A "08:00:00 > part2 >= 16:00:00" as B "16:00:00 > part2 >= 00:00:00" as C I wonder how to define it...

simon1524 · ‎09-26-2022

I want to split （SUBMIT_DATE） into “date” and “time”. Then define a value for 8 hours period, such as below. 0:00:00 - 8:00:00 = A 8:00:00 - 16:00:00 = B 16:00:00 - 0:00:00 = C

simon1524 · ‎09-26-2022

For example, the "SUBMIT_DATE" is split by date and time. Then define some period of time as a value(A/B/C). Can this be achieved? (SUBMIT_DATE="2021-03-09 14:30:48.0") ==> Split to "2021-03-09" and "14:30:48.0" 0:00:00 - 8:00:00 = A 8:00:00 - 16:00:00 = B 16:00:00 - 0:00:00 = C

simon1524 · ‎06-30-2022

With your query the data shows correctly. Thank you very much!!

simon1524 · ‎06-30-2022

There is something wrong with the data output by using apendcols. The data of Total_Actual is blank from 02-2022. But actually there has data all of months. May I know what's the reason..? index=sourceA PRIORITY="High" OR PRIORITY="Medium" OR PRIORITY="Low" WAS_CRITICAL="yes" | eval _time=strptime(FIRST_SOLVED_DATE,"%Y-%m-%d %H:%M:%S.%N") | timechart span=1mon count as Total | appendcols [search index=sourceA PRIORITY="Critical" | eval _time=strptime(FIRST_SOLVED_DATE,"%Y-%m-%d %H:%M:%S.%N") | timechart span=1mon count as Total_Actual] | eval Rate_%=round((Total_Actual/Total)*100, 2) | table _time, Total, Total_Actual, Rate_% | tail 12 | sort _time OUTPUT _time Total Total_Actual Rate_% 2021-07-01T00:00:00.000+0200 76 64 84.21 2021-08-01T00:00:00.000+0200 74 51 68.92 2021-09-01T00:00:00.000+0200 81 45 55.56 2021-10-01T00:00:00.000+0200 75 71 94.67 2021-11-01T00:00:00.000+0200 118 58 49.15 2021-12-01T00:00:00.000+0200 101 105 103.96 2022-01-01T00:00:00.000+0200 81 86 106.17 2022-02-01T00:00:00.000+0200 95 2022-03-01T00:00:00.000+0200 85 2022-04-01T00:00:00.000+0200 96 2022-05-01T00:00:00.000+0200 106 2022-06-01T00:00:00.000+0200 141

Posts	7
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎06-30-2022

Online Status	Offline
Date Last Visited	‎10-19-2022 02:13 AM

How to define time period?

Why are we having an appendcols issue?

Re: How to define time period

Re: How to define time period

Re: How to define time period

Re: How to define time period

How to define time period?

Re: appendcols issue

Why are we having an appendcols issue?