Skip to content

Commit 7158d17

Browse files
removed attribute
1 parent 1e5cddb commit 7158d17

File tree

1 file changed

+9
-9
lines changed

1 file changed

+9
-9
lines changed

explore-analyze/alerts-cases/cases/cases-as-data.md

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -24,16 +24,16 @@ After turning on cases as data, you do not need to manually create the analytics
2424
You also do not need to manually manage the analytics indices' index lifecycle management (ILM) policies. The indices are updated by a background task that runs every five minutes and applies a snapshot of the most current cases data. Note that historical case data is not retained; it gets overwritten whenever the indices are refreshed.
2525

2626
::::{note}
27-
After you create cases, {{es}} may take up to 10 minutes to index the new case data. If you create a new space, it can take up to an hour for new case analytics indices to form.
27+
There may be delays in indexing data and creating indices:
28+
- After making new cases, it may take up to 10 minutes to index the new case data.
29+
- After making a new space, it can take up to an hour for the case analytics indices for that space to form.
2830
::::
2931

3032
## Explore case data [explore-case-data]
3133

3234
::::{admonition} Requirements
33-
34-
* Your role has at least `read` and `view_index_metadata` access to the appropriate case anlaytics indices.
35+
* Your role needs at least `read` and `view_index_metadata` access to the appropriate case analytics indices.
3536
* You must have the appropriate subscription. Refer to the subscription page for [Elastic Cloud](https://www.elastic.co/subscriptions/cloud) and [Elastic Stack/self-managed](https://www.elastic.co/subscriptions) for the breakdown of available features and their associated subscription tiers.
36-
3737
::::
3838

3939
To explore case data:
@@ -43,31 +43,31 @@ To explore case data:
4343

4444
To help you start visualizing your case data, here are some sample {{esql}} queries that you can run from the [{{esql}} editor](../../../explore-analyze/query-filter/languages/esql-kibana.md#esql-kibana-get-started) in Discover.
4545

46-
* Find the total number of open cases in the default {{kib}} space:
46+
* Find the total number of open cases in the default space:
4747

4848
```console
4949
FROM .internal.cases.default-observability | STATS count = COUNT(*) BY status | WHERE status == "open"
5050
```
5151

52-
* Find the total number of in progress Stack Management cases in the default {{kib}} space:
52+
* Find the total number of in progress Stack Management cases in the default space:
5353

5454
```console
5555
FROM .internal.cases.default-cases | STATS count = COUNT(*) BY status | WHERE status == "in-progress"
5656
```
5757

58-
* Find the total number of closed {{observability}} cases in the default {{kib}} space:
58+
* Find the total number of closed {{observability}} cases in the default space:
5959

6060
```console
6161
FROM .internal.cases.default-observability | STATS count = COUNT(*) BY status | WHERE status == "closed"
6262
```
6363

64-
* Find Security cases that are open in the default {{kib}} space, and sort them by time, with the most recent at the top:
64+
* Find Security cases that are open in the default space, and sort them by time, with the most recent at the top:
6565

6666
```console
6767
FROM .internal.cases.default-securitysolution | WHERE status == "open" | SORT created_at DESC
6868
```
6969

70-
* Find the average time that it takes to close Security cases in the default {{kib}} space:
70+
* Find the average time that it takes to close Security cases in the default space:
7171

7272
```console
7373
FROM .internal.cases.default-securitysolution | STATS average_time_to_close = AVG(time_to_resolve)

0 commit comments

Comments
 (0)