Try the below
| stats values(total_run_time) as total_run_time, min(_time) as Start, max(_time) as End by id
| eval JobStart=strftime(Start, "%Y-%m-%dT%H:%M:%S.%Q")
| eval JobEnd=strftime(End, "%Y-%m-%dT%H:%M:%S.%Q")
| eval Duration=tostring(End-Start, "duration")
i presume each one should have some sort of correlation id.
... View more