No, the called_number is the same in the first and second record.
The more I think about, the more it seems that I need two separate searches. How would I do that?
Here's my current search that produces incorrect values for total # calls and missed calls. Maybe this search is not clever or efficient - sorry, I'm a newbie at Splunk:
... | convert dur2sec(call_duration) as duration
| eval missed=if(duration=0,1,0)
| eval wasputonhold=if(hold_time>0,1,0)
| stats count AS "Total # calls"
sum(missed) as "Missed calls"
sum(wasputonhold) as "Put on hold"
avg(ring_duration) AS mean_answertime
max(ring_duration) AS max_answertime
max(hold_time) AS max_wasputonhold
sum(duration) as Total_calltime
| eval Total_calltime=strftime(Total_calltime, "%H:%M:%S")
| eval mean_answertime=round(mean_answertime,1)
| eval mean_answertime=tostring(mean_answertime)." s"
| eval max_answertime=tostring(max_answertime)." s"
| eval max_wasputonhold=tostring(max_wasputonhold)." s"
| rename mean_answertime as "Mean answering time"
max_answertime as "Max. answering time"
max_wasputonhold as "Max. time on hold"
Total_calltime as "Total call time"
... View more