https://community.splunk.com/t5/Splunk-Search/One-search-to-source-multiple-dashboard-tables/m-p/91327#M23484 <P>Couldn't see to find a question like this here, but maybe my search for it is no good.</P> <P>What I'd like to do is have a single search run, that could populate multiple tables in a dashboard.</P> <P>As an example, say I have all my postfix mail logs in an index named 'mail'.</P> <P>I want to have a dashboard with three panels, each populated with the output of the below three searches:</P> <PRE><CODE>index=mail earliest=-24h | top client index=mail earliest=-24h | top to index=mail earliest=-24h | top from </CODE></PRE> <P>Is there a way to get at the data by only running the search once and manipulating the top outputs, instead of taking the resource cost of running that three separate times (one for each top output needed)?</P> <P>Thanks in advance,</P> <P>Scott</P> Thu, 18 Nov 2010 04:17:34 GMT skippylou 2010-11-18T04:17:34Z https://community.splunk.com/t5/Splunk-Search/One-search-to-source-multiple-dashboard-tables/m-p/91327#M23484 <P>Couldn't see to find a question like this here, but maybe my search for it is no good.</P> <P>What I'd like to do is have a single search run, that could populate multiple tables in a dashboard.</P> <P>As an example, say I have all my postfix mail logs in an index named 'mail'.</P> <P>I want to have a dashboard with three panels, each populated with the output of the below three searches:</P> <PRE><CODE>index=mail earliest=-24h | top client index=mail earliest=-24h | top to index=mail earliest=-24h | top from </CODE></PRE> <P>Is there a way to get at the data by only running the search once and manipulating the top outputs, instead of taking the resource cost of running that three separate times (one for each top output needed)?</P> <P>Thanks in advance,</P> <P>Scott</P> Thu, 18 Nov 2010 04:17:34 GMT https://community.splunk.com/t5/Splunk-Search/One-search-to-source-multiple-dashboard-tables/m-p/91327#M23484 skippylou 2010-11-18T04:17:34Z https://community.splunk.com/t5/Splunk-Search/One-search-to-source-multiple-dashboard-tables/m-p/91328#M23485 <P>This is possible, take a look at <A href="http://www.splunk.com/base/Documentation/4.1.5/Developer/PostProcess" rel="nofollow">http://www.splunk.com/base/Documentation/4.1.5/Developer/PostProcess</A>. </P> Thu, 18 Nov 2010 04:20:10 GMT https://community.splunk.com/t5/Splunk-Search/One-search-to-source-multiple-dashboard-tables/m-p/91328#M23485 christopherutz 2010-11-18T04:20:10Z https://community.splunk.com/t5/Splunk-Search/One-search-to-source-multiple-dashboard-tables/m-p/91329#M23486 <P>Fantastic, thanks!</P> <P>Scott</P> Thu, 18 Nov 2010 05:08:54 GMT https://community.splunk.com/t5/Splunk-Search/One-search-to-source-multiple-dashboard-tables/m-p/91329#M23486 skippylou 2010-11-18T05:08:54Z