1. If the same JobName field name is already exists,Trying to get average of column value of JobName's elapsedtime value
2. With the average value,I should compare the today's field name with previous date field name's value.
Eg: JobName: 'script_run' ElapsedTime: 5 -> Here I need to check whether the 'Script name' field name is already existing( In previous Date) or not. If exists, Compare the elapsedtime '5' with that yesterday or any previous day value of same 'script_run'. If the today's elapsed value is greater than previous day's value, I need to highlight in report. So iterating the today's each JobName with each jobName of previous day to compare the values of each elapsed time of each JobName is needed here.
JobNames are also different. so no any match case is not required here. Getting the JobNames with field name
index="application_**" host="W4Q**" sourcetype="log"
[search index="application_**" host="W4Q**" sourcetype="log" earliest=-1d@d latest=now
| top JobName,SecondsElapsed | table JobName,SecondsElapsed]
| stats avg(SecondsElapsed) as Duration by JobName,SecondsElapsed
| stats count(eval(if(SecondsElapsed > Duration,true,0))) as LongRun by JobName
| foreach *
[eval <<FIELD>>_VAL=if('<<FIELD>>'>Duration,'true',null())]
Any help for this.
Thanks
