I am getting audit log details from incident management system in the format attached. For each incident I need to calculate, total time took to resolve the incident. I want to exclude the time for which incident had status: Pending in log details field.
The time information is stored in field Audit Date.
The process goes like this:
1. fetch all records related to a particular incident from the available incoming data.
2. start calculating resolution time where log contains "Assignee: John" value till the time when log contains "Status: Resolved"
3. subtract the time where log contains "Status: Pending (3)" till the status is changed to "Status: In Progress "
