How to find a real time job is running morethan 30mins?

[Anud]

How  to find a real time job is running morethan 30 mins for example below screenshot.

Here need to create an alert for which job is running more than 30 mins. Now we are manually watching this job from SH -->activity-->job.

Thanks in Advance.

[SanjayReddy]

Hi @Anud 

Please try this 

| rest /services/search/jobs | search eventSorting=realtime
| eval RuntimeinMinutes =round(runDuration/60)
| where RuntimeinMinutes > 30
| rename title as QueryUsed
| table author QueryUsed RuntimeinMinutes

[Anud]

Hi,

i am not getting any details with the base search
| rest /services/search/jobs | search eventSorting=realtime

Here i observed that eventSorting have values desc and none only.

i need to identify when the real time job is running more than 30 mins under the SH-->activity-->job like below.