Splunk Search

Streamstats Time Sum When Specific Values

mikepangrac
Loves-to-Learn Lots

Hi All,

I'm stumped on the following search. The scenario is I'm trying to track the amount of time a support ticket is assigned to a support team and specific status, for the lifecycle of the ticket. The following |streamstats works great, assuming the ticket doesn't get assigned to the same team and status twice. (getting assigned out and back in) It currently sums the time between. Again, I only want to sum the time in a team and status, not including the time between where it goes out.

|dedup ticket_id,_time,ticket_arvig_status
|eval temp2=id+","+ticket_status
|search (ticket_team="TIER 2" AND ticket_status="tier 2 needed"
|streamstats range(_time) AS StatusDuration by ticket_id global=f window=2
|stats sum(StatusDuration) AS TotalStatusDuration by ticket_id, ticket_status, ticket_team
|stats avg(TotalStatusDuration) as averageage by ticket_id

Any help would be appreciated!

0 Karma

to4kawa
Ultra Champion

I'm not sure not including the time between where it goes out.
TotalStatusDuration ?

0 Karma

adonio
Ultra Champion

you cant range _time by ticket_id because you already deduped the ticket_id ...
meaning, you have only a single event (and therefore a single _time) for each ticket_id
can you share sample data and desired results?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...