device 1 -
went down at 8/1/2017 6:02:36 AM and came back up at 8/1/2017 6:05:02 AM.
downtime for this would be 6:05-6:02
can you define a key to make this work?
critical will always be followed by clear for the same device
Not very sophisticated;) but find my approach as reference below and stored in attached workbook version 10.3
1. lookup: LOOKUP(attr([Timestamp]),1)
2. downtime yes/no: if attr([Severity])='Critical' then datediff('second',attr([Timestamp]),[Lookup]) else 0 END
3. downtime: window_sum([downtime yes/no])
can you please share the workbook mentioned in the reply