https://community.splunk.com/t5/Splunk-Search/Hung-Job-Monitoring-via-Logs/m-p/559857#M159085 <P>I have a search string that details the last log entry for all running jobs [shown in ascending order] bar a few jobs [as either completed OR of little interest]...</P><P class="lia-indent-padding-left-30px"><EM>index=ee_rpa_uipath_platform AND OrganizationUnitID=19 | dedup RobotName | table User, RobotName, _time, Message | sort _time | search (NOT Message IN("*complete*", "*ended*") AND NOT RobotName="ALWORKER*") </EM></P><P>What I now want is to reduce the returned set to logs that are over 30 mins old i.e. if the log file has NOT been updated in the past 30mins then there is a good chance that the job has hung</P><P>I have tried the following command...</P><P class="lia-indent-padding-left-30px"><EM>index=ee_rpa_uipath_platform AND OrganizationUnitID=19 | dedup RobotName | table User, RobotName, _time, Message | sort _time | search (NOT Message IN("*complete*", "*ended*") AND NOT RobotName="ALWORKER*") <STRONG>| where earliest=-30m@m</STRONG></EM></P><P>...but I receive the following error...</P><P class="lia-indent-padding-left-30px"><SPAN>"Error in 'where' command: The operator at 'm@m' is invalid."</SPAN></P><P>Two questions</P><OL><LI>What's wrong with my syntax and/or</LI><LI>Is there a better way to to get the oldest last log entry from a set of job log files</LI></OL> Fri, 16 Jul 2021 18:05:11 GMT Mick_OBrien 2021-07-16T18:05:11Z https://community.splunk.com/t5/Splunk-Search/Hung-Job-Monitoring-via-Logs/m-p/559857#M159085 <P>I have a search string that details the last log entry for all running jobs [shown in ascending order] bar a few jobs [as either completed OR of little interest]...</P><P class="lia-indent-padding-left-30px"><EM>index=ee_rpa_uipath_platform AND OrganizationUnitID=19 | dedup RobotName | table User, RobotName, _time, Message | sort _time | search (NOT Message IN("*complete*", "*ended*") AND NOT RobotName="ALWORKER*") </EM></P><P>What I now want is to reduce the returned set to logs that are over 30 mins old i.e. if the log file has NOT been updated in the past 30mins then there is a good chance that the job has hung</P><P>I have tried the following command...</P><P class="lia-indent-padding-left-30px"><EM>index=ee_rpa_uipath_platform AND OrganizationUnitID=19 | dedup RobotName | table User, RobotName, _time, Message | sort _time | search (NOT Message IN("*complete*", "*ended*") AND NOT RobotName="ALWORKER*") <STRONG>| where earliest=-30m@m</STRONG></EM></P><P>...but I receive the following error...</P><P class="lia-indent-padding-left-30px"><SPAN>"Error in 'where' command: The operator at 'm@m' is invalid."</SPAN></P><P>Two questions</P><OL><LI>What's wrong with my syntax and/or</LI><LI>Is there a better way to to get the oldest last log entry from a set of job log files</LI></OL> Fri, 16 Jul 2021 18:05:11 GMT https://community.splunk.com/t5/Splunk-Search/Hung-Job-Monitoring-via-Logs/m-p/559857#M159085 Mick_OBrien 2021-07-16T18:05:11Z https://community.splunk.com/t5/Splunk-Search/Hung-Job-Monitoring-via-Logs/m-p/579502#M201931 <P>Re-visited, re-thought and re-wrote.&nbsp; This seems to work...</P><P class="lia-indent-padding-left-30px"><EM><FONT face="courier new,courier">index=ee_rpa_uipath_platform AND OrganizationUnitID=19 | dedup RobotName | table User, RobotName, _time, Message | sort _time | search (NOT Message IN("*complete*", "*ended*") AND NOT RobotName="ALWORKER*") <FONT color="#000000"><STRONG>| where _time &gt; relative_time(now(), "-1440m@m") AND _time &lt; relative_time(now(), "-30m@m")</STRONG></FONT></FONT></EM></P><P>&nbsp;I still do not understand what was wrong with original search string syntax</P> Wed, 29 Dec 2021 16:19:16 GMT https://community.splunk.com/t5/Splunk-Search/Hung-Job-Monitoring-via-Logs/m-p/579502#M201931 Mick_OBrien 2021-12-29T16:19:16Z