How to Collate Events By Matching String?

[ZCAMZ]

Hi All,

Im trying use Splunk to produce a table which will highlight the duration between the RUNNING event of one and the SUCCESS event of another Autosys job.

In this case the start job for each environment is denoted by a prefix ending *START_COMP_0 and the last job is *OSMPCONTROL_0.

If I only compare a single environment (ENV1...) then the search works fine however I would like to grab the duration between two events for multiple environments (ENV1, ENV2...).  Using the SPL below or something similar, is it possible to group the ENVs together based on matching string? 

Multiple Envs:

index=_* OR index=* sourcetype=autosys_vm1_event_demon AND (JobName=DWP_VME_DLACS_*_START_COMP_0 Status=RUNNING) OR (JobName=DWP_VME_DLACS_*_OSMPCONTROL_0 Status=SUCCESS)
| transaction maxevents=2
| table JobName duration _time

I have attached two screenshots, one of a single env which gives me my desired output and one where I stick a * in the search and how the search is grouping multiple events.

Multiple: 

multiple

Single working:

working single

TIA, Cameron. 

[isoutamo]

Hi

when You are using transaction You should use  startswith and endswith parameters to match start and end correctly. Also you should use some field which match those to correct job.

r. Ismo