Splunk Search

How to search duration of job?

AKG11
Path Finder

Hi, I am trying to build a query where I need Job duration.  Each job could run multiple time and its start/end time is recorded in multiple lines.
I remember using streamstats for this requirement but couldn't figure it out.


AKG11_0-1667988218620.png

Thanks



Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do each execution of the job have a unique id?

Do the jobs overlap?

Do the jobs have different names?

0 Karma

AKG11
Path Finder

Do each execution of the job have a unique id?
Ans: Unfortunately no, that's the issue. 

Do the jobs overlap?
Ans: Different jobs can overlap but not the same job. 

Do the jobs have different names?
Ans: Yes, there are jobs with different names.

I have done similar in past. I think I am very close to find the solution. I will update once done.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try something like this

| streamstats count(eval(status=="STARTING")) as instance by job
| stats min(_time) as starttime max(_time) as endtime by job instance
| eval duration=endtime-starttime
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...