Splunk Search

Display job time with total run and runtime of subtasks

aohls
Contributor

I am not sure the best way to ask this but we have a job with subtasks, and the subtasks have subtasks. I wanted to get the total runtime. These are not jobs related to Splunk, they are internal jobs we log times and steps. Currently I get

Job1|Sub1|Task1|1 minute
Job1|Sub1|Task2|5 minutes
Job1|Sub1|Task3|2 minutes
Job1|Sub2|Task1|10 minutes

I do not want to have Job1 show multiple times and I want it to have a total run time, then it would break down for each Sub task. I want this to almost be a collapsible list where Job1 can have multiple Subs and each sub with tasks but I do not want Job1 to get printed multiple times. Ideally I want Job1's only result to also show the total runtime of the job. Then each Subtask would break down the runtime of that specific subtask.

Tags (3)
0 Karma

ivanreis
Builder

please check the rest api command, it shows all the information relate with jobs, the name of the reports, runtime and others.

| rest /services/search/jobs

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...