To get that, you need to tell us what the incoming data looks like, exact field names and all.
You also need to get in the habit o aking sure to check the spelling and case of everything you code and post. Does organization have a capital "O" or not? Is the field called Name or JobName? Type or JobType? duration or length?
Here's a complete stab in the dark, which you'll have to adjust with the exact right spelling of the fields....
index=abc sourcetype=xyz source="/var/log/companies" Status=finished
| fields ScheduleTime WorkerStartTime WorkerEndTime, Organization, Host, JobType, JobName
| eval time=strptime(ScheduleTime, "%Y-%m-%d %H:%M:%S")
| eval st=strptime(WorkerStartTime, "%Y-%m-%d %H:%M:%S.%3N")
| eval et=strptime(WorkerEndTime, "%Y-%m-%d %H:%M:%S.%3N")
| eval DurationHrs = round( (et - st)/3600,2)
| table _time, ScheduleTime, JobType, JobName, Organization, Host, DurationHrs
Then, if you want to add up all those by JobType and JobName, then
| stats min(_time) as _time sum(DurationHrs) as DurationHrs by JobType, JobName, Organization, Host
or
| stats min(_time) as _time sum(DurationHrs) as DurationHrs values(JobName) as JobName by JobType, Organization, Host
... View more