the job: 0019295 which shows run time on Thu Jan 14 07:00:02:2016 actually ran on Wed Jan 13 07:00:19 2016
which is the time on the row below this event.
And that's the reason the timechart and the table shows different values.
| rename JobId as "Job ID",JobName as "Job Name" | streamstats current=f window=2 range(_time) as JobRunTime latest(_time) as EndTime earliest(_time) as StartTime | table "Job Name", "Job ID", StartTime , EndTime ,JobRunTime | dedup "Job ID" | eval StartTime=strftime(StartTime, "%c") |eval EndTime=strftime(EndTime, "%c") | eval JobRunTime=tostring(JobRunTime, "duration")
Not Sure why the dates are being changed or incremented by 1
I face the similar issue, in my case the user timezone was the problem.
In Spunk web, click your name and edit your account and save time zone as default system time zone and try.
I have attached the snapshot. For each jobid its correct runtime is a row below.
Job which shows runtime as Jan 14th its run time is Jan 13th