How can I write a search with a multifield value for job type and organization?

[kteng2024]

Hi there,

Below is the query for which i need the multi field value for job type and organization.

index=abc sourcetype=xyz source="/var/log/companies" Status=finished| eval  time=strptime(ScheduleTime, "%Y-%m-%d %H:%M:%S")
|eval st=strptime(WorkerStartTime, "%Y-%m-%d %H:%M:%S.%3N")
| eval et=strptime(WorkerEndTime, "%Y-%m-%d %H:%M:%S.%3N")
| eval duration = et - st| table Schedule_time , Type, Name, organization,  Host, length

output

Schedule_time               JobType          JobName        Organization                    Host                  length
2017-11-30 00:00:00.000       abc             compact              Google               apacheweb               73689.96

[DalJeanis]

To get that, you need to tell us what the incoming data looks like, exact field names and all.

You also need to get in the habit o aking sure to check the spelling and case of everything you code and post. Does organization have a capital "O" or not? Is the field called Name or JobName? Type or JobType? duration or length?

Here's a complete stab in the dark, which you'll have to adjust with the exact right spelling of the fields....

index=abc sourcetype=xyz source="/var/log/companies" Status=finished
| fields ScheduleTime WorkerStartTime WorkerEndTime, Organization, Host, JobType, JobName
| eval time=strptime(ScheduleTime, "%Y-%m-%d %H:%M:%S")
| eval st=strptime(WorkerStartTime, "%Y-%m-%d %H:%M:%S.%3N")
| eval et=strptime(WorkerEndTime, "%Y-%m-%d %H:%M:%S.%3N")
| eval DurationHrs = round( (et - st)/3600,2)
| table _time, ScheduleTime, JobType, JobName, Organization, Host, DurationHrs

Then, if you want to add up all those by JobType and JobName, then

| stats min(_time) as _time sum(DurationHrs) as DurationHrs by JobType, JobName, Organization, Host

or

| stats min(_time) as _time sum(DurationHrs) as DurationHrs values(JobName) as JobName by JobType, Organization, Host

[woodcock]

You have not shown any data nor explained how your search is failing.

[cpetterborg]

Example data? Be sure to use the 101010 button to show the data exactly. If it is secured data, at least anonymize it, but example data is needed.