How to execute two panels subsequently on a dashboard

[xiangtaner]

Hi,

I have two panels on the same dashboard, but the second one depends on the results of the first one and needs to input the lookup table generated from the first panel. How can set it up so that the second panel does not run until the first panel finishes?

Thanks!

[xiangtaner]

Thanks maciep for the input!

The first piece of code (or search in the first panel) creates a list of IP addresses which the second piece of code (or search in the second panel) takes in order to filter a big source by keeping only IP addresses in the list.

The first piece of code likes below:

search1
| table IP
| outputlookup ips.csv

The second piece of code takes in the lookup as:

sourcetype=bigsource | search [| inputlookup ips.csv | fields IP] | ...

I do want to combine these two pieces of code together so that I only need one panel, as you can see the first piece of code does nothing but just creating the list. If you have any good ideas to achieve this please do let me know.

So I have these two panels on the same dashboard, and the second panel depends on the lookup table created and finalized.

Greatly appreciate any ideas/suggestion!

[maciep]

There is the "depends" attribute that might be useful here. But I'm not fully understanding how the panels relate to each other. The first one generates a lookup table? Do you mean it's piping to outputlookup or using rest to actually create a lookup that the second panel needs? Or are you just tabling data that the user can click on to populate a search for the second panel? Or something else entirely?