jwahab377
Participant
ParticipantMTTR Report
We need to retrieve the total number of alerts along with the Mean Time To Resolve (MTTR) and Mean Time To Acknowledge (MTTA) for those alerts. I have not been able to find a suitable dashboard or re...
Forum Discussion
jamesramsden
Expert
ExpertIf you have a look in this table, you will see when date time stamps which might help you do some calculations
select * from master_events.events_cleared limit 10
for example, there is a Date_first, for when the event first occurred and Date_last when it had finished.
Active events are in a different table: select * from master_events.events_active limit 10
jwahab377Thanks James!
"This query is working as expected for smaller data sets. However, when I run it in the database tool, I am unable to retrieve a full month's data. Increasing the LIMIT to 10,000 causes the query to fail, while a smaller limit returns data only for a partial period (from mid-June to the beginning of July). I have attempted to update the query to select data from specific dates, but was unsuccessful.
SELECT * FROM master_events.events_cleared WHERE event_timestamp BETWEEN '2025-08-22' AND '2025-09-22 23:59:59' LIMIT 5000;
Am I doing any mistake?
- BryanHarding
Moderator
The `events_cleared` table is going to be quite substantial limited by the data retention in your environment so scale can very well impact query performance. I see that you're also specifying event_timestamp in your query, which is not a column within that table. Echoing what James already highlighted, date_first represents the timestamp of the first match and creation of the record and date_last represents the last occurrence of an alert for that entity matching that respective event policy.
While you are welcome to base off of date_first and date_last I would recommend using date_active and date_del. The date_active value represents the timestamp where the event record would have first been available to the UI; this matters when dealing with event policies that require a set number of occurrences within a specified timeframe (configured within the respective event policies) before becoming active event records. The date_del value represents the timestamp that the event record was cleared (e.g. no longer an active event). You also mentioned being interested in MTTA which would involve date_ack; the value tracking the timestamp of the user acknowledgement of the event record.
I am not aware of any ScienceLogic published reports, nor any Community-based reports that calculate SL1 event MTTA or MTTR at this time. If you are interested in such a report I would recommend contacting our Professional Services team through your CSM or, if you are saavy with PHP and SQL you may have interesting in Custom Report Development found here in our user documentation: https://docs.sciencelogic.com/latest/Content/Web_Data_View_and_Reporting/Reports/report_development_overview.htm
- jamesramsden
Running large queries is going to be difficult in the gui, as chrome will eventually run out of memory.
you are better off running directly on the db, or using one of the event reports already available, and do your calculations in excel.
