Need help with a query please: I have ticket data where the life cycle is Assigned, Work in Progress, Fixed, Closed and the ticket is assigned to our group ABC. I want to display only the tickets which are assigned and in progress to our group ABC. My end goal is to show ABC group's ticket count which are not fixed and closed. I have the below query so far: TICKET STATUS GROUP TIC12345 Assigned ABC Work in Progress ABC Fixed DEF Closed DEF index=* source=* group=ABC | stats latest(status) as l_status latest(group) as l_group by TICKET | search NOT l_status in("Fixed", "Closed") Result: TICKET STATUS GROUP TIC12345 Work in Progress ABC I was able to get the data however, I'm also getting ticket which are closed(because it is initially assigned to ABC and later it was closed by DEF). Appreciate your help!
... View more