example log data project_name=abc category=xyz job_id=1 stage_begin=compile time=2019-08-16 15:00:00 project_name=abc category=xyz job_id=1 stage_end=compile time=2019-08-16 15:03:00 project_name=abc category=xyz job_id=1 stage_begin=build time=2019-08-16 15:03:00 project_name=abc category=xyz job_id=1 stage_end=build time=2019-08-16 15:06:00 project_name=abc category=xyz job_id=1 stage_begin=artifacts time=2019-08-16 15:07:00 project_name=abc category=xyz job_id=1 stage_end=artifacts time=2019-08-16 15:12:00 project_name=abc category=xyz job_id=1 stage_begin=upload time=2019-08-16 15:13:00 project_name=abc category=xyz job_id=1 stage_end=upload time=2019-08-16 15:14:00 Need a output table like this project_name Category job_id compile_time build_time . artifacts_time upload_time abc xyz 1 3mins . 3 mins . 5 mins . 1min ... ... ... i tried to have a query to do stage begin and then join with job_id and get a query for stage_end which I can do only for 1 stage so I am not sure how to get all stages for a given job_id . I tried appendcols but it messes up when some job_id s don't have one of the fields or it fails after build , etc. Need help to get a report similar to the sample Thanks for the help. ... View more

Sample log data {‘job_id,:’1’, ‘stage_state’:’build_begin’,’stage_type:’build’,’start_time’:’2019-08-15 15:00:00’} {‘job_id,:’1’, ‘stage_state’:’build_end’,’stage_type:’build’,’endtime’:’2019-08-15 15:10:00’} {‘job_id,:’1’, ‘stage_state’:’exc_begin’,’stage_type:’exec’,’start_time’:’2019-08-15 15:10:01’} stage_state’:’exc_end’,’stage_type:’exec’,’end_time’:’2019-08-15 15:20:00’} I am trying get a table like this output Job_id stage time taken 1 Build. 10 1 Exc. 10 1 Total. 20 I am new to Splunk I tried a few things but. I cannot get nothing close to expected answer Thanks ... View more