Incidents of same type in past 3 days

Hi Sam,
I have a scenario where I need to identify the recurrence of the same incident category on a computer.
Each incident record tracks the computer name, the date, and the category of the incident.
I want to highlight those computers which had in the past 3 days the same category of incident.
My dataset is more extended with many other categories that classify an incident, but for sake of simplicity, I attached a barebone example. I had figured out I could use the churn and returning customer pattern, but after some hours of testing I got nothing valid.
I don’t need an off the shelf solution, rather a direction to what you think might be the best approach

Thanks and regards

Roberto

Same type of incident in previous 3 days.xlsx (23.3 KB)

Hello @Roberto,

Thank You for posting the query onto the Forum.

I’m attaching the PBIX file of the working for the reference.

Hoping this meets your requirement.

Thanks & Warm Regards,
Harsh

Total Incidents in Last 3 Days.pbix (87.2 KB)

Hi @Roberto

There are several ways to solve this. Following your 2 dimensions table logic, you can use a SWITCH:

Incidents =
VAR CurrentDate = SELECTEDVALUE ( Dates[Date] ) 
VAR Last3Days = TOPN (
    3,
    FILTER ( All ( Dates ), Dates[Date] <= CurrentDate ),
   [Date],
    DESC
) 
RETURN SWITCH (
    true (),
    CALCULATE ( COUNTROWS ( Incidents ), Incidents[Type] = "Bravo", Last3Days ) > 2,
    "Bravo >2", CALCULATE (
        COUNTROWS ( Incidents ),
        Incidents[Type] = "Charlie", Last3Days
    ) > 2,
    "Charlie >2"
)

Notice that SWITCH only shows one incident type, you would need to use IFs, to show when several incidents types occur and concatenate their result

Hope it helps

Best,
Diego

Hi @Harsh ,
thanks for your kind reply.

Total Incidents in Last 3 Days.pbix (77.6 KB)
I tried to use your model but there is something I still don’t get.
My need is to identify recurring incidents in the previous 3 days on the same computer with the same category incident.
My attempts simply failed because I still do not get the gist of the filtering approach and of DAX in general.

Your help is greatly appreciated

Regards

Hi, @Harsh @diego,
I think I made it, eventually.

I slightly changed the formula proposed by Harsh adding an ALLEXCEPT to ignore all filters on the Data table (the incidents), but the Computer and Category. Also, the <= was making the formula counting also the incident of the current date, but changing to < made the trick so I got the total number of incidents in the previous N days (added a param for debugging purposes).
Thanks for all your suggestions.
I feel I got a better grasp now

Any suggestion is more then welcome!

Regards

Roberto

Total Incidents in Last N Days =
VAR Last_Date = LASTDATE( Data[Date] )

RETURN
CALCULATE( [Total Incidents] ,
FILTER( ALL( Dates ) ,
Dates[Date] > Last_Date - [days Value] &&
Dates[Date] < Last_Date // changed from <= to < because I need to count how many incident in previous N days excluded the current day
),

ALLEXCEPT(Data,Data[Computer], Data[Category]) //remove all filters but on Computer and Category

)

Same type of incident in previous 3 days.xlsx (23.3 KB) Total Incidents in Last N Days v2.pbix (102.6 KB)

Hello @Roberto,

Excellent job done :+1:.

I’m really glad that you found the solution :slightly_smiling_face:.

I was just about to provide the formula and you posted the solution.

If possible you can try the below formula and see if it works for you.

Total Incidents in Last 3 Days = 
VAR LastDates = LASTDATE( Data[Date] )
VAR Computer = SELECTEDVALUE( Data[Computer] )
VAR Category = SELECTEDVALUE( Data[Category] )

RETURN
CALCULATE( [Total Incidents] , 
    FILTER( ALL( Dates ) , 
        Dates[Date] >= LastDates - 3 &&
        Dates[Date] < LastDates ) , 
    FILTER( ALL( Data ) , 
        Data[Computer] = Computer && 
        Data[Category] = Category ) )

I’m providing a screenshot below of the result as well as the PBIX file of my working. I’ve incorporated the formula in the file that you’ve provided.

Thanks & Warm Regards,
Harsh

Total Incidents in Last N Days v2.pbix (99.7 KB)

2 Likes

Hi @Harsh it worked like a charm. Trimming mine on < and > comparison on the date results are equally correct! :smiley:

Thanks a lot

Roberto

Hello @Roberto,

I’m really glad that it worked out for you. :slightly_smiling_face:

Thanks & Warm Regards,
Harsh

Glad to hear it’s resolved!
Wanted to share another approach with you guys as well…

Total Incidents L3D = 
VAR MaxDate = MAX( Dates[Date] )
VAR MyPC = SELECTEDVALUE( Data[Computer] )
VAR MyCat = SELECTEDVALUE( Data[Category] )

VAR vTable =
    FILTER(
        CALCULATETABLE( Data,
            TOPN( 3, FILTER( ALL( Dates[Date] ), Dates[Date] <=  MaxDate ), [Date], DESC )),
            Data[Category] = MyCat &&
            Data[Computer] = MyPC
        )
VAR Result = COUNTROWS( vTable )
RETURN 

IF( Result =1, BLANK(), Result)
1 Like

Hi @Melissa,
thanks for this!
There are 2 differences though: it includes incidents for the current day and on the last date doesn’t catch the repeating NIC issue incident on Server 3. Also @Harsh’s and mine fail on the last date :thinking:


Total Incidents in Last 3 Days.pbix (88.7 KB)

Okay so TOPN returns the last 3 days including ‘today’, so you’re only looking back 2 days
Adjusting for that and the numbering, you’ll get this. Will you give it a go - thanks!

Total Incidents L3D Melissa = 
VAR MaxDate = MAX( Dates[Date] )
VAR MyPC = SELECTEDVALUE( Data[Computer] )
VAR MyCat = SELECTEDVALUE( Data[Category] )

VAR vTable =
    FILTER(
        CALCULATETABLE( Data,
            TOPN( 4, FILTER( ALL( Dates[Date] ), Dates[Date] <=  MaxDate ), [Date], DESC )),
            Data[Category] = MyCat &&
            Data[Computer] = MyPC
        )
VAR Result = COUNTROWS( vTable )

RETURN 

IF( Result =1, BLANK(), 
    IF( Result >1, Result -1, Result ))

.
With this result


.

I hope this is helpful.

Still something I don’t get on the last line. All three formulas return 2 while it should be 1 (Server3 NIC issue) but also line 01/12/2020 Server 3 NIC issue on your formula return 1 and should be 0 like Harsh’s and mine.

Moreover can you please point me to some of the videos in the training material to let me understand why MAX(Date) ignores filter context? I banged my head so many times I just copy and past w/o understanding.

Thanks!!!

Roberto

image

Hi Roberto,

I don’t understand…
When I check the virtual table, I see incident 15 & 16 on the 12th

and for the 15th

.

It doesn’t, I need an aggregator to identify the Dates[Date] visible in the current context.

That’s weird. Anyway I got better understanding on ALLEXCEPT and TOPN functions, and how to use filtering. Thanks @Melissa @Harsh

Hi @Roberto,

Glad to hear you got better understanding of ALLEXCEPT, TOPN and filtering. :+1:
What’s the solution you ended up using?

Hi @Melissa,
I’m using mine for now, but yours and @Harsh will do the same. I might switch in case I find performance issues. I’ve to work on large set of data and I found than TOPN is not always the best solution. Also filtering can increase queries execution time. It would be nice to have some material on how to build model using large/big data sets.