You mean something like this? | eval date = strftime(_time, "%F")
| stats min(_time) as start max(_time) as end by date
| eval duration = round(end - start)
| fields - start end date dura...
See more...
You mean something like this? | eval date = strftime(_time, "%F")
| stats min(_time) as start max(_time) as end by date
| eval duration = round(end - start)
| fields - start end date duration 2024-10-04 61267 2024-10-05 8 Here is the emulation | makeresults format=csv data="jobId, date, skip1, skip2, time
Job1, 10/4/2024, 20241004, 10/4/2024, 0:38:27
Job1, 10/4/2024, 20241004, 10/4/2024, 0:38:41
Job 2, 10/4/2024, 20241004, 10/4/2024, 17:39:12
Job 2, 10/4/2024, 20241004, 10/4/2024, 17:39:24
Job 2, 10/4/2024, 20241004, 10/4/2024, 17:39:34
Job1, 10/5/2024, 20241004, 10/4/2024, 0:38:27
Job1, 10/5/2024, 20241004, 10/4/2024, 0:38:35"
| eval _time = strptime(date . " " . time, "%m/%d/%Y %H:%M:%S")
``` data emulation above ```