Hi, I am trying to build a query where I need Job duration. Each job could run multiple time and its start/end time is recorded in multiple lines.
I remember using streamstats for this requirement but couldn't figure it out.
Thanks
Do each execution of the job have a unique id?
Do the jobs overlap?
Do the jobs have different names?
Do each execution of the job have a unique id?
Ans: Unfortunately no, that's the issue.
Do the jobs overlap?
Ans: Different jobs can overlap but not the same job.
Do the jobs have different names?
Ans: Yes, there are jobs with different names.
I have done similar in past. I think I am very close to find the solution. I will update once done.
You could try something like this
| streamstats count(eval(status=="STARTING")) as instance by job
| stats min(_time) as starttime max(_time) as endtime by job instance
| eval duration=endtime-starttime