A computer-implemented method for data analysis in a distributed computing system, the method comprising: accessing data, stored in a storage device of a first processing zone (104, 106, and 108), that is associated with a particular child job created from a particular distributed data processing job that has been executed; detecting, from the data stored in the storage device, identifying information that identifies the particular child job created from the particular distributed data processing job; in response to detecting the identifying information that identifies the particular child job created from the particular distributed data processing job, determining that the identifying information that identifies the particular child job and second identifying information stored in a storage device of a second processing zone share a common prefix; in response to determining that the identifying information that identifies the particular child job and the second identifying information stored in the storage device of the second processing zone share a common prefix, identifying an additional child job as being created from the particular distributed data processing job; correlating particular output data associated with the particular child job and additional output data associated with the additional child job created from the particular distributed data processing job; determining performance data for the particular distributed data processing job based on correlation data, resulting from the correlating of the particular output data associated with the particular child job and the additional output data associated with the additional child job created from the particular distributed data processing job, and based on the particular output data associated with the particular child job and the additional output data associated with the additional child job; determining that the performance data satisfies performance criteria; and in response to determining that the performance data satisfies the performance criteria, triggering an action to be performed. accessing data, stored in a storage device of a first processing zone (104, 106, and 108), that is associated with a particular child job created from a particular distributed data processing job that has been executed; detecting, from the data stored in the storage device, identifying information that identifies the particular child job created from the particular distributed data processing job; in response to detecting the identifying information that identifies the particular child job created from the particular distributed data processing job, determining that the identifying information that identifies the particular child job and second identifying information stored in a storage device of a second processing zone share a common prefix; in response to determining that the identifying information that identifies the particular child job and the second identifying information stored in the storage device of the second processing zone share a common prefix, identifying an additional child job as being created from the particular distributed data processing job; correlating particular output data associated with the particular child job and additional output data associated with the additional child job created from the particular distributed data processing job; determining performance data for the particular distributed data processing job based on correlation data, resulting from the correlating of the particular output data associated with the particular child job and the additional output data associated with the additional child job created from the particular distributed data processing job, and based on the particular output data associated with the particular child job and the additional output data associated with the additional child job; determining that the performance data satisfies performance criteria; and in response to determining that the performance data satisfies the performance criteria, triggering an action to be performed.