https://community.splunk.com/t5/Splunk-Search/How-to-coalesce-events-with-different-values-for-status-field/m-p/416031#M119755 <P>Does this job only run once per day?</P> Mon, 15 Apr 2019 17:16:18 GMT grittonc 2019-04-15T17:16:18Z https://community.splunk.com/t5/Splunk-Search/How-to-coalesce-events-with-different-values-for-status-field/m-p/416030#M119754 <P>I have this search that will display the following</P> <PRE><CODE>index=autosys source= jobName= | where statusText="SUCCESS" OR statusText="RUNNING" OR statusText="FAILURE" OR statusText="JOBFAILURE" | eval startTime=if(statusText=="RUNNING",timestamp,null) | eval failureTime=if(statusText=="FAILURE",timestamp,null) | eval successTime=if(statusText=="SUCCESS",timestamp,null) | streamstats last(successTime) as prev_successtime,last(failureTime) as prev_failuretime,last(startTime) as prev_startTime current=f window=1 | table jobName startTime successTime failureTime | rename startTime as "Start Time" successTime as "Success Time" failureTime as "Failure Time" </CODE></PRE> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6905i3B6F044E496986EB/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>I would like to have the most recent startTime match up with the latest SuccessTime or FailureTime in the same row. Is this possible?</P> Mon, 15 Apr 2019 15:05:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-coalesce-events-with-different-values-for-status-field/m-p/416030#M119754 x213217 2019-04-15T15:05:22Z https://community.splunk.com/t5/Splunk-Search/How-to-coalesce-events-with-different-values-for-status-field/m-p/416031#M119755 <P>Does this job only run once per day?</P> Mon, 15 Apr 2019 17:16:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-coalesce-events-with-different-values-for-status-field/m-p/416031#M119755 grittonc 2019-04-15T17:16:18Z https://community.splunk.com/t5/Splunk-Search/How-to-coalesce-events-with-different-values-for-status-field/m-p/416032#M119756 <P>this one in particular yes, but there will be ones that run on a variety of schedules</P> Mon, 15 Apr 2019 17:33:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-coalesce-events-with-different-values-for-status-field/m-p/416032#M119756 x213217 2019-04-15T17:33:20Z https://community.splunk.com/t5/Splunk-Search/How-to-coalesce-events-with-different-values-for-status-field/m-p/416033#M119757 <P>Just add this to the end:</P> <PRE><CODE>| selfjoin jobName </CODE></PRE> <P>You can also do this:</P> <PRE><CODE>| stats values(*) AS * BY jobName </CODE></PRE> Mon, 15 Apr 2019 19:14:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-coalesce-events-with-different-values-for-status-field/m-p/416033#M119757 woodcock 2019-04-15T19:14:11Z