index=remedy source=srmwo ASGRP="Packaging" (Status=5 OR Status=4) | eval date=coalesce(Completed_Date,Actual_Start_Date) | table date Work_Order_ID | bin span=1d date | reverse | streamstats values(date) as range by Work_Order_ID | reverse | eval start=mvindex(range,0), end=mvindex(range,1) | streamstats current=f values(start) as start_p1 by Work_Order_ID | eval end=if(start=start_p1,null(),end) | eval timerange=if(isnull(end),start,mvrange(start,end,86400)) | fields Work_Order_ID timerange | mvexpand timerange | rename timerange as _time | table _time Work_Order_ID This query makes daily log by each Work_Order_ID. After this, let's aggregate what you want. ... View more

I came up with this solution... My Search | dedup Work_Order_ID | eval Avg_Days_to_Assign=round((Actual_Start_Date-Submit_Date)/86400,0) | eval Avg_Days_to_Complete_after_Assign=round((Completed_Date-Actual_Start_Date)/86400,0) | eval Avg_Total_Days_from_Submit_to_Completion=round((Completed_Date-Submit_Date)/86400,0) | eval Month=strftime(Completed_Date,"%Y-%m (%b)") | stats count(eval(Status="5")) AS Completed, avg(Avg_Days_to_Assign) as Avg_Days_to_Assign, avg(Avg_Days_to_Complete_after_Assign) as Avg_Days_to_Complete_after_Assign, avg(Avg_Total_Days_from_Submit_to_Completion) as Avg_Total_Days_from_Submit_to_Completion by Month | eval Avg_Days_to_Assign=round(Avg_Days_to_Assign,0) | eval Avg_Days_to_Complete_after_Assign=round(Avg_Days_to_Complete_after_Assign,0) | eval Avg_Total_Days_from_Submit_to_Completion=round(Avg_Total_Days_from_Submit_to_Completion,0) ... View more