MTTR Report

The `events_cleared` table is going to be quite substantial limited by the data retention in your environment so scale can very well impact query performance. I see that you're also specifying event_timestamp in your query, which is not a column within that table. Echoing what James already highlighted, date_first represents the timestamp of the first match and creation of the record and date_last represents the last occurrence of an alert for that entity matching that respective event policy.

While you are welcome to base off of date_first and date_last I would recommend using date_active and date_del. The date_active value represents the timestamp where the event record would have first been available to the UI; this matters when dealing with event policies that require a set number of occurrences within a specified timeframe (configured within the respective event policies) before becoming active event records. The date_del value represents the timestamp that the event record was cleared (e.g. no longer an active event). You also mentioned being interested in MTTA which would involve date_ack; the value tracking the timestamp of the user acknowledgement of the event record.

I am not aware of any ScienceLogic published reports, nor any Community-based reports that calculate SL1 event MTTA or MTTR at this time. If you are interested in such a report I would recommend contacting our Professional Services team through your CSM or, if you are saavy with PHP and SQL you may have interesting in Custom Report Development found here in our user documentation: https://docs.sciencelogic.com/latest/Content/Web_Data_View_and_Reporting/Reports/report_development_overview.htm