How to get the real time status of a job?

[loveforsplunk]

I am trying to get the current status of a job that is running now from the logs.

Suppose there are job events like STARTED, RUNNING, FAILURE, SUCCESS.

Based on a transaction, I need to find out the Jobs which have STARTED, but did not complete (still in running state).

So, if I have one job which has changed the status from running to success, this job should not come in the events. Only if it is in running status and has not succeeded , only then I should see the result in splunk events.

[livehybrid]

Hi,
Do you have a unique ID for each job that runs? If so - try something like this:
index=yourIndex [search index=yourIndex status="STARTED" | fields yourUniqueIDField] | transaction yourUniqueIDField | search status!="FAILURE" status!="SUCCESS"
This should give you data for everything that has Started, but where there is not a FAILURE or SUCCESS log line.
You might actually find you dont need the subsearch, the following might also work:
index=yourIndex status=* | transaction yourUniqueIDField | search status!="FAILURE" status!="SUCCESS"
I hope this helps!

[loveforsplunk]

What do u mean by unique ID . I can say each job names are different . Can I consider that as unique id ? and what does transaction do in splunk?
And also I ant the real time transactions, suppose the log I have appends each run for a job . In that case a job will generate a log having all the transaction status : eg. started, running, success or failure.
Ur search is giving me results for all the jobs that has one time went into running status which is not what I need.
I need only those jobs which are at present in running status and has not succeeded or failed.