- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks in advance.
I have events from two different sources:
The first source (let's call it Source A) has the following fields in its events:
1. Name of job
2. Parent job
Source B:
1. Name of Job (Same as source A, but could be parent or child)
2. runTime
The run-time of the parent jobs can be broken down by the run-times of its child, but the correlation between parent and child can only be found in the first source.
I am stumped by this because the information is from two different sources. Any help will be appreciated!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![somesoni2 somesoni2](https://community.splunk.com/legacyfs/online/avatars/100305.jpg)
Assuming you want to chart runtime of one parent job at a time . Try something like this:
source="B" [search source="A" parentJob="ParentJobNameYouWantPieChartFor" | stats count by jobName | table jobName]
| stats sum(runTime) as runTime by jobName
Other assumptions:
- You can search source A using source="A" and source B using source="B"
- On source="A", field names are jobNameand parentJob
- On source="B", field names are jobNameand runTime
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![somesoni2 somesoni2](https://community.splunk.com/legacyfs/online/avatars/100305.jpg)
Assuming you want to chart runtime of one parent job at a time . Try something like this:
source="B" [search source="A" parentJob="ParentJobNameYouWantPieChartFor" | stats count by jobName | table jobName]
| stats sum(runTime) as runTime by jobName
Other assumptions:
- You can search source A using source="A" and source B using source="B"
- On source="A", field names are jobNameand parentJob
- On source="B", field names are jobNameand runTime
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@richgalloway
I would like to create a pie chart of how the children run-times breakdown the parent's run-time
@xpac
One parent, multiple children relationship. Children can't have children jobs.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
Is this a single level relation?
Like, do all jobs belong to some parent job, and that's it? Or do some jobs have child jobs, and those have child jobs, and so on?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![richgalloway richgalloway](https://community.splunk.com/legacyfs/online/avatars/140500.jpg)
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
What is your question? What is your desired output?
If this reply helps you, Karma would be appreciated.
![](/skins/images/FE4825B2128CA5F641629E007E333890/responsive_peak/images/icon_anonymous_message.png)