计算预期结束时间时不包括周末

时间:2019-02-05 14:13:07

标签: splunk splunk-query splunk-calculation

我正在做4级严重性的支持票。 级别1要求在4小时内解决票证 级别2希望在8小时内解决票证。 级别3要求在72小时(即3天)内解决票证。 级别4预计可在120小时(即5天)内解决票证。 因此,如果在星期四 4级严重程度举起票,应该在下周三解决。但是,我的代码现在在计算中包括了周六和周日,因此可以由下周一来解决 在计算预期时间时如何排除周六和周日?

 index="test" sourcetype="incident_all_v3" 
    | eval check = strptime(strftime(_time , "%d/%m/%Y") , "%d/%m/%Y") 
    | eventstats max(check) as checktime 
    | where checktime = check 
    | dedup 1 ticket_id sortby -_time 
    | join ticket_id type=left 
        [ search index="test" sourcetype="incident_assigned" 
        | eval check = strptime(strftime(_time , "%d/%m/%Y") , "%d/%m/%Y") 
        | eventstats max(check) as checktime 
        | where checktime = check 
        | eval move_datetime = strptime(move_datetime, "%Y-%m-%d %H:%M:%S") 
        | dedup 1 ticket_id sortby -move_datetime 
        | eval move_datetime = strftime(move_datetime, "%Y-%m-%d %H:%M:%S") 
        | fields ticket_id move_datetime] 
    | eval realtime = if(isnotnull(move_datetime), move_datetime, create_time) 
    | eval create_time_epoch = strptime(realtime, "%Y-%m-%d %H:%M:%S") 
    | lookup app_name.csv queue_name output vendor, app_name 
    | search vendor = "Company" AND ticket_type = "Incident" AND app_name = "*" 
    | eval diff_seconds = now() - create_time_epoch 
    | eval diff_days = diff_seconds / 86400 
    | eval status = if (ticket_state="Closed" OR ticket_state="Completed" OR ticket_state="For Verification" OR ticket_state="Verified", "resolved" , "unresolved") 
    | where status = "unresolved" AND ticket_type = "Incident" 
    | eval SEVERITY = case ( SLA == "SLA Level 1", "1", SLA == "SLA Level 2", "2", SLA == "SLA Level 3", "3", SLA == "SLA Level 4", "4") 
    | eval SEVERITY = "Sev ".SEVERITY 
    | lookup sev_target.csv SEVERITY output TARGET 
    | eval SLA_DEADLINE = case(SEVERITY = "Sev 4", create_time_epoch + (TARGET*3600), SEVERITY = "Sev 3", create_time_epoch + (TARGET*3600), SEVERITY = "Sev 2", create_time_epoch + (TARGET*3600), SEVERITY = "Sev 1", create_time_epoch + (TARGET*3600)) 
    | eval SLA_DEADLINE = strftime(SLA_DEADLINE,"%Y-%m-%d %H:%M:%S") 
    | table *

SLA results 所以对于这张照片,在2019-01-18(星期五),严重性为4级,截止日期为2019-01-23,这不是我想要的,因为它包含周六和周日。应该是2019-01-25。

0 个答案:

没有答案