Base search to use in a new window as a drilldown dashboard

[Nadhiya123]

Hello All,

Is there a way to put a base search in the first dashboard which drilldowns to a new dashboard where it uses the base search from the first dashboard.

[niketn]

@Nadhiya123, how many base searches are being passed from one dashboard to another? What may vary in your base searches. Can you give examples of base search from first dashboard?

[Nadhiya123]

@niketn

There is one search which i use to display a map in my first dashboard.

it drilldowns to the new next dashboard based on the lat/lon,

base search in 1st map dashbaord:
......
.......| stats max("count(xx)") as sessions, max(upperBound) as X, max(lowerBound) as Y by NPANXX,LAT,LNG
| geostats max(sessions) as sessions, max(X) as X, max(Y) as Y latfield=LAT longfield=LNG outputlatfield=LAT outputlongfield=LNG globallimit=0 | eval High_No_Of_Calls = if(sessions > $HIGH$,sessions,0)
| eval Medium_No_Of_Calls = if((sessions > $Medium$ AND sessions < $HIGH$ ),sessions,0) | eval Normal_No_Of_Calls = if(sessions <= $Medium$,sessions,0)
| fields - sessions, X, Y

drilldown search 1:
.........
......| stats max("count(xx)") as sessions, max(upperBound) as X, max(lowerBound) as Y by NPANXX,LAT,LNG | eval High_No_Of_Calls = if(sessions > $HIGH$,sessions,0)
| eval Medium_No_Of_Calls = if((sessions > $Medium$ AND sessions < $HIGH$ ),sessions,0) | eval Normal_No_Of_Calls = if(sessions <=$Medium$,sessions,0) | fields - sessions, X, Y| where LAT>=$lattitude1$ AND LAT<$lattitude2$ AND LNG>=$longitude1$ AND LNG<$longitude2$|table NPANXX,High_No_Of_Calls,Medium_No_Of_Calls,Normal_No_Of_Calls|where (High_No_Of_Calls=$High$ AND Medium_No_Of_Calls=$Med$ AND Normal_No_Of_Calls=$Normal$) |head 1|eval High_No_Of_Calls=$High$|eval Medium_No_Of_Calls=$Med$|eval Normal_No_Of_Calls=$Normal$|table NPANXX,High_No_Of_Calls,Medium_No_Of_Calls,Normal_No_Of_Calls

drilldownsearch 2:

| eventstats max("count(xx)") as sessions, max(upperBound) as X, max(lowerBound) as Y by NPANXX,LAT,LNG | eval High_No_Of_Calls = if(sessions >$HIGH$,sessions,0)
| eval Medium_No_Of_Calls = if((sessions > $Medium$ AND sessions < $HIGH$ ),sessions,0) | eval Normal_No_Of_Calls = if(sessions <=$Medium$,sessions,0) | fields - sessions, X, Y| where LAT>=$lattitude1$ AND LAT<$lattitude2$ AND LNG>=$longitude1$ AND LNG<$longitude2$
|table _time,....|where (High_No_Of_Calls=$High$ AND Medium_No_Of_Calls=$Med$ AND Normal_No_Of_Calls=$Normal$) OR (Medium_No_Of_Calls=$Med$ AND Normal_No_Of_Calls=$Normal$)|sort - _time|eval m=max($High$,$Med$,$Normal$) | streamstats c | where c<=m|table ....
Trying to work on the performance issue.

Thanks

[gcusello]

Hi Nadhiya123,
you can pass as token a search from the first dashboard to the second but only if it's not so long because there are limits to url lenght.
Anyway do you want to pass a fixed search or a different one depending by the click on the first dashboard panel?
Maybe you could create secondary dashboard search passing as token only parameters.

Bye.
Giuseppe