Splunk Search

Display job time with total run and runtime of subtasks

aohls
Contributor

I am not sure the best way to ask this but we have a job with subtasks, and the subtasks have subtasks. I wanted to get the total runtime. These are not jobs related to Splunk, they are internal jobs we log times and steps. Currently I get

Job1|Sub1|Task1|1 minute
Job1|Sub1|Task2|5 minutes
Job1|Sub1|Task3|2 minutes
Job1|Sub2|Task1|10 minutes

I do not want to have Job1 show multiple times and I want it to have a total run time, then it would break down for each Sub task. I want this to almost be a collapsible list where Job1 can have multiple Subs and each sub with tasks but I do not want Job1 to get printed multiple times. Ideally I want Job1's only result to also show the total runtime of the job. Then each Subtask would break down the runtime of that specific subtask.

Tags (3)
0 Karma

ivanreis
Builder

please check the rest api command, it shows all the information relate with jobs, the name of the reports, runtime and others.

| rest /services/search/jobs

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...