compare todays time duration with 30 days time duration.If if exceeds threshold(1.2*30days avg)send email alert,compare current Job duration with last 30 days average.If its exceeds threshold(1.2*30 days avg) send an email alert

[thomaap]

PROBLEM DESCRIPTION:compare todays time duration with 30 days time duration.If if exceeds threshold(1.2*30days avg)send email alert
PLEASE FIND BELOW QUERY.However i see a discrepancy in the 30 days average for jobs exceeding 60 minutes.Can you advise if i am missing a step

index=MY_INDEX sourcetype=foo JOB=JOBNAME earliest= -30d@d latest= now()
|dedup JOB,STATUS
| eval startTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="RUNNING",strftime(_time, "%a %B %d %Y %H:%M:%S")),endTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="SUCCESS",strftime(_time, "%a %B %d %Y %H:%M:%S")), terminateTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="TERMINATED",strftime(_time, "%a %B %d %Y %H:%M:%S"))
| eval sTime=strptime(startTime,"%a %B %d %Y %H:%M:%S")
| eval eTime=strptime(endTime,"%a %B %d %Y %H:%M:%S")
| eval tTime=strptime(startTime,"%a %B %d %Y %H:%M:%S")
| eventstats latest(STATUS) AS STATUS BY JOB
| transaction JOB,startTime,endTime
| eval e_Time=if(STATUS="TERMINATED" OR eTimeThreshold

,Please find below query.However i see that the average calculated for jobs running over an hour appears to be wrong

index=MY_INDEX sourcetype=autosys_demon* JOB="JOBNAME" earliest= -30d@d latest= now()
|dedup JOB,STATUS
| eval startTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="RUNNING",strftime(_time, "%a %B %d %Y %H:%M:%S")),endTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="SUCCESS",strftime(_time, "%a %B %d %Y %H:%M:%S")), terminateTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="TERMINATED",strftime(_time, "%a %B %d %Y %H:%M:%S"))
| eval sTime=strptime(startTime,"%a %B %d %Y %H:%M:%S")
| eval eTime=strptime(endTime,"%a %B %d %Y %H:%M:%S")
| eval tTime=strptime(startTime,"%a %B %d %Y %H:%M:%S")
| eventstats latest(STATUS) AS STATUS BY JOB
| transaction JOB,startTime,endTime
| eval e_Time=if(STATUS="TERMINATED" OR eTimeThreshold

[thomaap]

reposting query
index=MY_INDEXsourcetype=autosys_demon* JOB=JOBNAME earliest= -30d@d latest= now()
|dedup JOB,STATUS
| eval startTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="RUNNING",strftime(_time, "%a %B %d %Y %H:%M:%S")),endTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="SUCCESS",strftime(_time, "%a %B %d %Y %H:%M:%S")), terminateTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="TERMINATED",strftime(_time, "%a %B %d %Y %H:%M:%S"))
| eval sTime=strptime(startTime,"%a %B %d %Y %H:%M:%S")
| eval eTime=strptime(endTime,"%a %B %d %Y %H:%M:%S")
| eval tTime=strptime(startTime,"%a %B %d %Y %H:%M:%S")
| eventstats latest(STATUS) AS STATUS BY JOB
| transaction JOB,startTime,endTime
| eval e_Time=if(STATUS="TERMINATED" OR eTimeThreshold