I am using the following search which returns a table with three rows:
| streamstats current=f last(_time) as NewTime first(_time) as LastTask by Item
| eval Duration=NewTime-_time
| eval RunTime=(Duration/60)
| table JobName, RunTime, _time
The issue I am having is that my time is only caluculated for two of the rows, the earliest two. The final record is not calculating a time so I am getting the following:
JobName,RunTime, _time
Name1, ,5:00
Name2,120,4:00
Name3,60,2:00
Is there a way I can force it to calculate the final time?
The problem is that there is no last(_time) for row appearing first in result (would be the last result if sorted by _time), hence no calculation is done. What should the RunTime value for it?