https://community.splunk.com/t5/Splunk-Search/how-to-execute-a-search-everyday-and-every-8-hours/m-p/479633#M192935 <P>You may try crontab syntax generator like <A href="https://www.crontab-generator.org/">https://www.crontab-generator.org/</A>.</P> Fri, 27 Sep 2019 09:30:26 GMT larry02 2019-09-27T09:30:26Z https://community.splunk.com/t5/Splunk-Search/how-to-execute-a-search-everyday-and-every-8-hours/m-p/479628#M192930 <P>I have three teams in industrial company, the first starts work at 6am, the second at 2pm, and the third at 10pm, the working time of each team is 8 hours, I wanted to count the amount carried out each team with a dynamic way, at each start of the team the counting starts again in a single dashboard.<BR /> Please can you help me how to do this query <BR /> i'm a beginner in splunk </P> Wed, 11 Sep 2019 09:06:05 GMT https://community.splunk.com/t5/Splunk-Search/how-to-execute-a-search-everyday-and-every-8-hours/m-p/479628#M192930 amani28 2019-09-11T09:06:05Z https://community.splunk.com/t5/Splunk-Search/how-to-execute-a-search-everyday-and-every-8-hours/m-p/479629#M192931 <P>After creating the Alert, Select Run on Cron Schedule with <CODE>* 6,14,22 * *</CODE></P> Wed, 11 Sep 2019 10:22:14 GMT https://community.splunk.com/t5/Splunk-Search/how-to-execute-a-search-everyday-and-every-8-hours/m-p/479629#M192931 SathyaNarayanan 2019-09-11T10:22:14Z https://community.splunk.com/t5/Splunk-Search/how-to-execute-a-search-everyday-and-every-8-hours/m-p/479630#M192932 <P>thank you for your answer SathyaNarayanan ,<BR /> I want to execute it in dashboard not as alert <BR /> i don't know how to do this</P> Wed, 11 Sep 2019 11:00:30 GMT https://community.splunk.com/t5/Splunk-Search/how-to-execute-a-search-everyday-and-every-8-hours/m-p/479630#M192932 amani28 2019-09-11T11:00:30Z https://community.splunk.com/t5/Splunk-Search/how-to-execute-a-search-everyday-and-every-8-hours/m-p/479631#M192933 <P>I will suggest you to create 3 panel in dashboard stating , First shift Amount , second shift Amount and third shift Amount . Each panel time range you can keep as per the shift timings. </P> <P>Please give your current query to give more inputs. </P> Thu, 12 Sep 2019 05:57:56 GMT https://community.splunk.com/t5/Splunk-Search/how-to-execute-a-search-everyday-and-every-8-hours/m-p/479631#M192933 SathyaNarayanan 2019-09-12T05:57:56Z https://community.splunk.com/t5/Splunk-Search/how-to-execute-a-search-everyday-and-every-8-hours/m-p/479632#M192934 <P>this is my query is:<BR /> sourcetype=allf |spath|rename AUTOEXPORTFILE.ProgramName as produit |stats count as x by produit|where produit="\TELIA-SUEDE-E\TELIA-SUEDE-E.KYJOB" | eventstats sum(x) as result</P> <P>I want to run this query in real time in single panel but at each start of team the counting starts again (teams are independent)</P> Thu, 12 Sep 2019 08:02:24 GMT https://community.splunk.com/t5/Splunk-Search/how-to-execute-a-search-everyday-and-every-8-hours/m-p/479632#M192934 amani28 2019-09-12T08:02:24Z https://community.splunk.com/t5/Splunk-Search/how-to-execute-a-search-everyday-and-every-8-hours/m-p/479633#M192935 <P>You may try crontab syntax generator like <A href="https://www.crontab-generator.org/">https://www.crontab-generator.org/</A>.</P> Fri, 27 Sep 2019 09:30:26 GMT https://community.splunk.com/t5/Splunk-Search/how-to-execute-a-search-everyday-and-every-8-hours/m-p/479633#M192935 larry02 2019-09-27T09:30:26Z https://community.splunk.com/t5/Splunk-Search/how-to-execute-a-search-everyday-and-every-8-hours/m-p/479634#M192936 <P>You may try crontab syntax generator like <A href="https://www.crontab-generator.org/">https://www.crontab-generator.org/</A></P> Fri, 27 Sep 2019 09:32:18 GMT https://community.splunk.com/t5/Splunk-Search/how-to-execute-a-search-everyday-and-every-8-hours/m-p/479634#M192936 larry02 2019-09-27T09:32:18Z