Hello Folks, I am having some Autosys Job that runs multiple times in a day,  having status lifecycle of Starting, Running, Success . Since I don't have anything to differentiate between each lifecycle, I need to calculate Start and Endtime of each instance of job run. I tried using streamstats but not getting desired output. ...| streamstats reset_after="("status="SUCCESS"")" first(_time) as StartTime last(_time) as EndTime values(jobname) BY jobname   Appreciate if I can get some help. Cheers   ... View more

I am trying to output the results of the SPL query to lookup file via OUTPUTLOOKUP command in query itself using SPLUNK Alerts. (I am not using the alert function to send the data to CSV as I have conditional state to output the data to CSV) It works intermittently and there are times that when data is not getting added to CSV unless manual run of query. Can someone please assist or share some inputs? ... View more