I have three teams in industrial company, the first starts work at 6am, the second at 2pm, and the third at 10pm, the working time of each team is 8 hours, I wanted to count the amount carried out each team with a dynamic way, at each start of the team the counting starts again in a single dashboard.
Please can you help me how to do this query
i'm a beginner in splunk
I will suggest you to create 3 panel in dashboard stating , First shift Amount , second shift Amount and third shift Amount . Each panel time range you can keep as per the shift timings.
Please give your current query to give more inputs.
this is my query is:
sourcetype=allf |spath|rename AUTOEXPORTFILE.ProgramName as produit |stats count as x by produit|where produit="\TELIA-SUEDE-E\TELIA-SUEDE-E.KYJOB" | eventstats sum(x) as result
I want to run this query in real time in single panel but at each start of team the counting starts again (teams are independent)