Hello @ITWhisperer , I think the information provided by me earlier, was a bit ambiguous. Basically, there is one event each generated w.r.t the JOB. For e.g. when it starts, then runs, some other values, stops. When the events are of such nature, the given solution does not work. I have made some changes to your sample events to better replicate mine. | makeresults | eval event="A,started:A,running:A,other unnecessary value:A,stopped:B,started:B,running:B,other unnecessary value:C,started:C,running:C,other unnecessary value:C,stopped" | eval event=split(event,":") | mvexpand event | eval job=mvindex(split(event,","),0) | eval status=split(mvindex(split(event,","),1),";") | fields job status | fields - _time | search status!=stopped status=started You will notice that both the status!=stopped status=started and status=started are returning the same result in this (my) scenario. Is there any way to compare the events and only return those jobs that are only in started and have not stopped yet. Your help in this regard is appreciated 🙂
... View more
