How to chart total runtime for the last 15 days for a job running overnight?

[sjafferali]

I have to report out my job logs which spans from night 9PM to Morning 10AM. I have a field called total_run_time and I want to chart this for the last 15 days. Can someone let me know how to achieve it in Splunk? I was able to chart for daily total runtime based on_time, but since my job starts the previous day and ends on the current day, I do not know how to chart it for the last 15 days.

I was able to get the total runtime for the last job running from 9PM to 10AM using the earliest and latest command but, I do not know how to chart for 15 days.

Can someone help?

[Sfry1981]

Try the below

| stats values(total_run_time) as total_run_time, min(_time) as Start, max(_time) as End by id 
| eval JobStart=strftime(Start, "%Y-%m-%dT%H:%M:%S.%Q") 
| eval JobEnd=strftime(End, "%Y-%m-%dT%H:%M:%S.%Q") 
| eval Duration=tostring(End-Start, "duration")

i presume each one should have some sort of correlation id.