That did the trick, think you again for the excellent help.  Have a good week.   Thanks, Tom ... View more

You are awesome, I was able to get it working. index=healthcheck integrationName="Opsgenie Edge Connector - Splunk" alert.message = "STORE_117_RSO - Unreachable" "entity.source"=Meraki | rename alert.message AS "Branch" | transaction "alert.id", alert.message startswith=Create endswith=Close keepevicted=true Branch | stats sum(duration) as total_duration by Branch | eval percent_downtime = (total_duration / (86400*7)) *100   Sorry, I just have one last question, this actually gives me the Downtime, how would I also show a percentage of Uptime? Wish I could give you 100 Kudos 🙂  ... View more

Hello, Thank you for the very quick response, much appreciated and helpful.  I have been testing the uptime you provided to obtain the percentage, but am not very good yet at the search creations.  This is the Search I am using:   index=healthcheck integrationName="Opsgenie Edge Connector - Splunk" alert.message = "STORE*" "entity.source"=Meraki | transaction "alert.id", alert.message startswith=Create endswith=Close keepevicted=true | where closed_txn=0 | fields alert.updatedAt, alert.message, alertAlias, alert.id, action, "alertDetails.Alert Details URL", closed_txn, _time, dv_number, "alert.createdAt" | spath 'alert.createdAt' | eval Created=strftime ('alert.createdAt'/1000,"%m-%d-%Y %I:%M:%S %p") | rename alert.message AS "Branch" | table Created, Branch | sort by Created DESC Can't figure out what the stats sum(duration) should be by.  The goal is to have a percentage of the time between the Create and Close Transaction out of 7 days. Thanks again for all of the help, Tom ... View more