hi,
i have a search to get duration of the job, let's say startswith=started endswith=success
But in some case the job may fail, now it should be enddswith=FAILURE
now i want to write single search to get SUCCESS OR FAILURE JOB and their duration, starttime, endtime and status
Ex:
| transaction JOB startswith="EVENT: STARTJOB" endswith="STATUS: SUCCESS" -- this is only for success
| transaction JOB startswith="EVENT: STARTJOB" endswith="STATUS: SUCCESS or FAILURE" - ITS NOT WORKING
... View more