I am trying to figure out a way to calculate the time for: Time taken for a reviewer to assign the notable ticket from the creation time. Time taken for the notable in progress till close. notable |search NOT suppression |eval _time=strftime(_time,"%Y/%m/%d %T") |eval review_time=strftime(review_time,"%Y/%m/%d %T") |eval assign_time = case(isnotnull(owner), _time) | eval close_time = case(status=5, review_time) |stats min(_time) as notable_time min(assign_time) as assign_time min(close_time) as close_time by AlertTitle,owner This is giving me notable created time and closed time, but not the state change time. ... View more