To create a Workflow in Splunk

[Real_captain]

Hi 

Is it possible to create a workflow like below in Splunk. 

We have 5 jobs running everyday and the start/end time with status is captured in the Splunk logs. 

We want to create a workflow as below using the start/end time and status of the jobs: 

[Real_captain]

HI @gcusello 
Request is to display the status of the jobs in the format as attached below in the excel. 
1. These jobs ( Job A , Job B , Job C , Job D, Job E, Job F) are executed once a day and the start time/end time/status of these jobs are captured in splunk. We need to monitor these jobs and highlight the status 

Sample of output we would like in our dashboard: 

[gcusello]

Hi @Real_captain ,

ok, try something like this:

<your_search>
| stats 
     values("Start Time") AS "Start Time"
     values("End Time") AS "End Time"
     values(Status) AS Status
     BY Job
| transpose column_name=Job header_field=Job

Please, check the syntax of the transpose command because I cannot test it.

Ciao.

Giuseppe

[gcusello]

Hi @Real_captain ,

your request is just a little vague.

what do you want to monitor:

that all the steps are correctly completed?

that they are completed in the prefixed time,

what else?

is there a transaction_Id or something else to correlate events?

the five steps have a daily frequency or which one?

Then, what do you want to display, could you share a sample of the output that you would have?

Ciao.

Giuseppe