Thank you @yuanliu ! This worked really well. I added my eval commands to it as well and was able to produce the table that I was seeking, with your great query as a guide. I've expanded the time range to 14 days bc I realized 7 days was a little pointless since most of my batches only run M-F. My final query ended up being:
index=*app_pcf cf_app_name="mddr-batch-integration-flow" "posbatch04" earliest=-14d@d latest=-0d@d
| eval dayback = mvrange(0, 14)
| eval day = mvmap(dayback, if(_time < relative_time(now(), "-" . dayback . "d@day") AND relative_time(now(), "-" . tostring(dayback + 1) . "d@day") < _time, dayback, null()))
| stats min(_time) as Earliest max(_time) as Latest by day
| fieldformat Earliest = strftime(Earliest, "%F %T")
| fieldformat Latest = strftime(Latest, "%F %T")
| eval day = "day -" . tostring(day + 1)
| eval Elapsed_Time=Latest-Earliest, Start_Time_Std=strftime(Earliest,"%H:%M:%S:%Y-%m-%d"), End_Time_Std=strftime(Latest,"%H:%M:%S:%Y-%m-%d")
| eval Elapsed_Time=Elapsed_Time/60
Lastly I will figure out how to organize this by Day in desc order; right now it is sorting the results by another column...
Much appreciated for the help and the fast response, I would have never figured this out 🙂
... View more