Like this:
| makeresults
| eval raw="DATETIME: 2017-08-21 22:26:45.92 -0700
JOBNAME: CIBF593D
MSGTXT: CIBF593D - ENDED - TIME=22.26.45::DATETIME: 2017-08-21 22:26:42.02 -0700
JOBNAME: CIBF593D
MSGTXT: CIBF593D - STARTED - TIME=22.26.42"
| makemv raw delim="::"
| mvexpand raw
| rename raw AS _raw
| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"
| rex "(?ms)DATETIME:\s+(?<_time>[^\r\n]+).*?JOBNAME:\s+(?<JOBNAME>\S+).*?MSGTXT:\s+(?<MSGTXT>.*)"
| eval _time=strptime(_time, "%Y-%m-%d %H:%M:%S.%2N %Z")
| eval startTime=if(match(MSGTXT, "- STARTED -"), _time, null())
| eval endTime=if(match(MSGTXT, "- ENDED -"), _time, null())
| stats earliest(startTime) AS startTime latest(endTime) AS endTime by JOBNAME
| convert ctime(*Time)
... View more