https://community.splunk.com/t5/Splunk-Search/How-to-search-duration-of-job/m-p/620252#M215609 <P><SPAN>Do each execution of the job have a unique id?<BR /></SPAN>Ans: Unfortunately no, that's the issue.&nbsp;<BR /><BR /><SPAN>Do the jobs overlap?</SPAN><BR />Ans: Different jobs can overlap but not the same job.&nbsp;<BR /><BR /><SPAN>Do the jobs have different names?</SPAN><BR />Ans: Yes, there are jobs with different names.<BR /><BR />I have done similar in past. I think I am very close to find the solution. I will update once done.<BR /><BR /></P> Wed, 09 Nov 2022 11:26:29 GMT AKG11 2022-11-09T11:26:29Z https://community.splunk.com/t5/Splunk-Search/How-to-search-duration-of-job/m-p/620244#M215604 <P>Hi, I am trying to build a query where I need Job duration.&nbsp; Each job could run multiple time and its start/end time is recorded in multiple lines.<BR />I remember using streamstats for this requirement but couldn't figure it out.<BR /><BR /><BR /></P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="AKG11_0-1667988218620.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/22400iE52FA88B7F3A978D/image-size/medium?v=v2&amp;px=400" role="button" title="AKG11_0-1667988218620.png" alt="AKG11_0-1667988218620.png" /></span></P> <P>Thanks</P> <P><BR /><BR /></P> Wed, 09 Nov 2022 15:08:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-duration-of-job/m-p/620244#M215604 AKG11 2022-11-09T15:08:40Z https://community.splunk.com/t5/Splunk-Search/How-to-search-duration-of-job/m-p/620249#M215608 <P>Do each execution of the job have a unique id?</P><P>Do the jobs overlap?</P><P>Do the jobs have different names?</P> Wed, 09 Nov 2022 11:00:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-duration-of-job/m-p/620249#M215608 ITWhisperer 2022-11-09T11:00:19Z https://community.splunk.com/t5/Splunk-Search/How-to-search-duration-of-job/m-p/620252#M215609 <P><SPAN>Do each execution of the job have a unique id?<BR /></SPAN>Ans: Unfortunately no, that's the issue.&nbsp;<BR /><BR /><SPAN>Do the jobs overlap?</SPAN><BR />Ans: Different jobs can overlap but not the same job.&nbsp;<BR /><BR /><SPAN>Do the jobs have different names?</SPAN><BR />Ans: Yes, there are jobs with different names.<BR /><BR />I have done similar in past. I think I am very close to find the solution. I will update once done.<BR /><BR /></P> Wed, 09 Nov 2022 11:26:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-duration-of-job/m-p/620252#M215609 AKG11 2022-11-09T11:26:29Z https://community.splunk.com/t5/Splunk-Search/How-to-search-duration-of-job/m-p/620278#M215619 <P>You could try something like this</P><LI-CODE lang="markup">| streamstats count(eval(status=="STARTING")) as instance by job | stats min(_time) as starttime max(_time) as endtime by job instance | eval duration=endtime-starttime</LI-CODE> Wed, 09 Nov 2022 13:15:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-duration-of-job/m-p/620278#M215619 ITWhisperer 2022-11-09T13:15:21Z