##1

(index=_internal sourcetype=scheduler status="completed" (host=sh*.*splunk*.* OR host=si*.*splunk*.*)) 
| eval window_time=if(isnotnull(window_time),window_time,0), execution_latency=max((dispatch_time - (scheduled_time + window_time)),0) 
| timechart eval(round(avg(execution_latency), 0)) as latency by app

##2

(group="searchscheduler" index=_internal sourcetype=splunkd (host=sh*.*splunk*.* OR host=si*.*splunk*.*)) 
| timechart minspan=30s sum(completed) as completed_count, Sum(total_runtime) as total_runtime 
| eval total_runtime=round(total_runtime,0)