What is the difference between run_time and total_run_time?

[Taruchit]

Hello all,

I need help to understand the difference between two fields run_time (fetched from index: _internal) and total_run_time (fetched from index:_audit).

I tried to execute search for same id and for events with same timestamp in the two searches  I observed different values for the two fields.

Any guidance or information will be very helpful.

Thank you

Taruchit

[Taruchit]

I fetched below threads will have information about the two fields:-

https://community.splunk.com/t5/Splunk-Search/Running-Saved-Searches-with-Default-Index-internal/m-p...

@kristian_kolb shared details about field run_time: How long time it took to execute the search (in seconds)

https://community.splunk.com/t5/Splunk-Search/What-is-this-search-startup-time-in-audit-index/m-p/32...

@splunker12er shared details about field total_run_time: Time in seconds that has been taken for the job to complete

It would be helpful if you could help to elaborate the difference between two fields.

Thank you