Ideally, JOB should start with Status as either RUNNING or STARTJOB or maybe both and it can end with either status as Termination, failure, Inactive, or success.
Examples:
[11/27/2021 08:00:00] TEST EVENT: STARTJOB JOB: A
[11/27/2021 08:00:05] TEST EVENT: CHANGE_STATUS STATUS: RUNNING JOB: A
[11/27/2021 08:06:23] TEST EVENT: CHANGE_STATUS STATUS: SUCCESS JOB: A
[11/28/2021 08:00:00] TEST EVENT: STARTJOB JOB: A
[11/28/2021 08:00:05] TEST EVENT: CHANGE_STATUS STATUS: RUNNING JOB: A
[11/28/2021 08:00:05] TEST EVENT: CHANGE_STATUS STATUS: FAILURE JOB: A
[11/28/2021 09:06:23] TEST EVENT: CHANGE_STATUS STATUS: SUCCESS JOB: A
[11/26/2021 08:00:05] TEST EVENT: CHANGE_STATUS STATUS: RUNNING JOB: B
[11/26/2021 20:06:23] TEST EVENT: CHANGE_STATUS STATUS: FAILURE JOB: B
[11/25/2021 08:00:00] TEST EVENT: STARTJOB JOB: C
[11/25/2021 20:06:23] TEST EVENT: CHANGE_STATUS STATUS: INACTIVE JOB: C
I have more than 1400 jobs, some are running daily, some monthly, and some quarterly.
In this scenario, Ultimately I am looking to calculate the last 90 days' average of duration (job end time - job start time) but somehow events are not getting properly grouped.
Below is the query currently I am using:-
Example 1
| eval end=case(_raw LIKE "%INACTIVE%","FAIL", _raw LIKE "%TERMINAT%","FAIL", _raw LIKE "%FAILURE%","FAIL" ,_raw LIKE "%SUCCESS%","FAIL",true(),"NA")
| reverse
| sort - _time limit=0
| transaction JOB startswith="*STARTJOB* AND *RUNNING*" endswith="end="FAIL"" keeporphans=true maxevents=9999999 keepevicted=true
Example 2
| transaction JOB startswith=(STATUS="RUNNING" OR STATUS="STARTJOB") endswith=(*TERMINATED*) OR (*FAILURE*) OR (*INACTIVE*) OR (*SUCCESS*) keeporphans=true maxevents=9999999 keepevicted=true
Any help would be highly appreciated.
Thanks in advance.
