I have to report out my job logs which spans from night 9PM to Morning 10AM. I have a field called total_run_time and I want to chart this for the last 15 days. Can someone let me know how to achieve it in Splunk? I was able to chart for daily total runtime based on_time , but since my job starts the previous day and ends on the current day, I do not know how to chart it for the last 15 days.
I was able to get the total runtime for the last job running from 9PM to 10AM using the earliest and latest command but, I do not know how to chart for 15 days.
Can someone help?
... View more