Combining two results into one CSV file from Dashboard

[earakam]

Hi

I am trying to figure out this.

In dashboard, i have two different panels with different searches.
How can I combine those two results by clicking the "export" button on the bottom left to output as one CSV file.
I know that I can do this if i use CLI search or some scripts, but I specifically want to do this from UI in Dashboard.

Could someone help me with this?

Thank you.

[chimell · Accepted solution]

Hi
If your xml code is like this:

<form>
   <label>Show Hide Using checkbox</label>
     <row>
     <panel>
       <table >
         <search>
           <query>index=_internal | stats c by sourcetype</query>
           <earliest>-60m@m</earliest>
           <latest>now</latest>
         </search>
       </table>
     </panel>
     <panel>
       <table >
         <search>
           <query>index=_internal | stats c by host</query>
           <earliest>-60m@m</earliest>
           <latest>now</latest>
         </search>
       </table>
     </panel>
   </row>
 </form>

I advise you firstly to combine your two searches in on search and use outputcsv command to export a result

index=_internal | stats c by sourcetype|appendcols[search index=_internal | stats c by host]|outputcsv myresult

Or secondly use this option in advance xml to export you result:

 <module name="Export"/>

[earakam]

thanks chimell!

[chimell]

good thanks

[chimell]

Hi
I forget to rename the second count c as c1 to make difference
use the following

 index=_internal | stats c by sourcetype|appendcols[search index=_internal | stats c as c1 by host]|outputcsv myresult