reposting query
index=MY_INDEXsourcetype=autosys_demon* JOB=JOBNAME earliest= -30d@d latest= now()
|dedup JOB,STATUS
| eval startTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="RUNNING",strftime(_time, "%a %B %d %Y %H:%M:%S")),endTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="SUCCESS",strftime(_time, "%a %B %d %Y %H:%M:%S")), terminateTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="TERMINATED",strftime(_time, "%a %B %d %Y %H:%M:%S"))
| eval sTime=strptime(startTime,"%a %B %d %Y %H:%M:%S")
| eval eTime=strptime(endTime,"%a %B %d %Y %H:%M:%S")
| eval tTime=strptime(startTime,"%a %B %d %Y %H:%M:%S")
| eventstats latest(STATUS) AS STATUS BY JOB
| transaction JOB,startTime,endTime
| eval e_Time=if(STATUS="TERMINATED" OR eTimeThreshold
... View more