topic Re: How to get the job start time, end time and duration for each day for last 7 days? in Splunk Dev https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432571#M7758 <P>Yes it contains multiple jobs</P> Thu, 31 May 2018 15:07:27 GMT abhi04 2018-05-31T15:07:27Z How to get the job start time, end time and duration for each day for last 7 days? https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432561#M7748 <P>How to get the job start time, end time and duration for each day for last 7 days? Below is the sample log:</P> <P>/afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - started - time=(2018-05-30-20.01.39)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - started - time=(2018-05-30-21.00.01)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - started - time=(2018-05-30-21.01.00)</P> Tue, 29 Sep 2020 19:47:31 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432561#M7748 abhi04 2020-09-29T19:47:31Z Re: How to get the job start time, end time and duration for each day for last 7 days? https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432562#M7749 <P>These all say 'started' so I would assume these are all start times? Are there different logs that are end times? or is the end time something derived from what is here?</P> Thu, 31 May 2018 11:54:05 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432562#M7749 kmaron 2018-05-31T11:54:05Z Re: How to get the job start time, end time and duration for each day for last 7 days? https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432563#M7750 <P>YEs ,</P> <P>So for one job say gc01iwcdl we have multiple start time and end time mentioned for date 29 as you can see below. So we want the oldest start time mentioned as start time and latest end time as end time for this job for each day for last 7 days.</P> <P>5/29/18 <BR /> 11:36:58.000 PM <BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - ENDED - time=(2018-05-29-22.36.59)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - ENDED - time=(2018-05-30-03.05.45)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - ENDED - time=(2018-05-30-20.00.03)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - ENDED - time=(2018-05-30-20.01.40)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - ENDED - time=(2018-05-30-21.00.02)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - ENDED - time=(2018-05-30-21.01.01)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - ENDED - time=(2018-05-30-22.00.03)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - ENDED - time=(2018-05-30-22.01.01)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - ENDED - time=(2018-05-30-23.00.02)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - ENDED - time=(2018-05-30-23.01.00)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - started - time=(2018-05-29-22.36.58)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - started - time=(2018-05-30-03.05.43)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - started - time=(2018-05-30-20.00.00)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - started - time=(2018-05-30-20.01.39)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - started - time=(2018-05-30-21.00.01)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - started - time=(2018-05-30-21.01.00)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - started - time=(2018-05-30-22.00.00)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - started - time=(2018-05-30-22.01.00)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - started - time=(2018-05-30-23.00.00)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - started - time=(2018-05-30-23.01.00)</P> Tue, 29 Sep 2020 19:47:39 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432563#M7750 abhi04 2020-09-29T19:47:39Z Re: How to get the job start time, end time and duration for each day for last 7 days? https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432564#M7751 <P>Yes,we have multiple start time and end time for a particular job for same day.we want to take the latest end time as end time and oldest start time as start time for that particular date and job ignoring other time .</P> Thu, 31 May 2018 12:10:52 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432564#M7751 abhi04 2018-05-31T12:10:52Z Re: How to get the job start time, end time and duration for each day for last 7 days? https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432565#M7752 <P>Then please provide a proper sample that includes all the relevant event types. If you want help to come up with a solution, please don't let us guess what your data looks like.</P> <P>Also: getting the oldest start of the day and latest end, means when the job runs multiple times, you just interpret that as one long run? I don't know the context of course, but that doesn't sound very logical to me...</P> Thu, 31 May 2018 12:21:41 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432565#M7752 FrankVl 2018-05-31T12:21:41Z Re: How to get the job start time, end time and duration for each day for last 7 days? https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432566#M7753 <P>5/29/18 <BR /> 11:36:58.000 PM <BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - ENDED - time=(2018-05-29-22.36.59)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - ENDED - time=(2018-05-30-03.05.45)<BR /> /afiw/batch/scripts/gc01iwcdl_afdw.ksh: Job gc01iwcdl_afdw - ENDED - time=(2018-05-30-20.00.03)</P> <P>5/29/18 <BR /> 11:36:50.000 PM <BR /> ... 13 lines omitted ...<BR /> /afiw/batch/scripts/gc01iwcdl_ins.ksh: Job gc01iwcdl_ins - started - time=(2018-05-30-20.01.39)<BR /> /afiw/batch/scripts/gc01iwcdl_ins.ksh: Job gc01iwcdl_ins - started - time=(2018-05-30-21.00.02)<BR /> /afiw/batch/scripts/gc01iwcdl_ins.ksh: Job gc01iwcdl_ins - started - time=(2018-05-30-21.01.00)</P> Tue, 29 Sep 2020 19:47:41 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432566#M7753 abhi04 2020-09-29T19:47:41Z Re: How to get the job start time, end time and duration for each day for last 7 days? https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432567#M7754 <P>provided the same</P> Thu, 31 May 2018 12:53:51 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432567#M7754 abhi04 2018-05-31T12:53:51Z Re: How to get the job start time, end time and duration for each day for last 7 days? https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432568#M7755 <P>And is this in splunk as separate events (one event per line, with time=() mapped to _time) or somehow batched together?</P> Thu, 31 May 2018 13:04:38 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432568#M7755 FrankVl 2018-05-31T13:04:38Z Re: How to get the job start time, end time and duration for each day for last 7 days? https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432569#M7756 <P>This is one event and _time not mapped to time (</P> Thu, 31 May 2018 13:18:07 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432569#M7756 abhi04 2018-05-31T13:18:07Z Re: How to get the job start time, end time and duration for each day for last 7 days? https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432570#M7757 <P>And can such an event contain multiple jobs? Your example only includes 1 job, with multiple start/end times.</P> <P>And is it always sorted like this with first all the end times and then all the start times?</P> <P>Personally I think I would start by investing a bit of time in ingesting this data properly. Splitting it up in individual events with a proper timestamp. From that it should be fairly straightforward to find earliest start and latest end and do some reporting on that.</P> Thu, 31 May 2018 13:26:42 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432570#M7757 FrankVl 2018-05-31T13:26:42Z Re: How to get the job start time, end time and duration for each day for last 7 days? https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432571#M7758 <P>Yes it contains multiple jobs</P> Thu, 31 May 2018 15:07:27 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-get-the-job-start-time-end-time-and-duration-for-each-day/m-p/432571#M7758 abhi04 2018-05-31T15:07:27Z