How to get all events data for further processing?

[fjp2485]

Hi,

In our application we have to
1. visualize all events' data retrieved by the given search
2. And we have to use all events' data in further processing.
However in the <progress> and <done> events only the first event's data are accessible (in the $result.field$ tokens). I'm wondering why don't these tokens contain values of the current event. Could you tell me if is there a way to get all events' data for further processing?

Thanks in advance,
fjp2485

[fjp2485]

Hi Vatsal,

Thanks for your quick answer. That shows an interesting approach: to link a search to another one.
But I don't see that our task can be solved simply with such linked searches.
Let me explain our goal:

There are three search results on our dashboard.
1. The first one takes its input from XML files in subfolders of a given folder and shows the result in a table in increasing time order. (This search contains installation results overview.)
Then the user clicks on a column in this table. The drill down operation takes the subfolder of the selected item (installation duration and overall result) and initiates two other searches in that subfolder. In addition the clicked item shall be shown in a brighter color.
2-3. These searches run in the above mentioned subfolder and take their input from different XML files and show their contents (result of installation steps and result of system integration tests).

So far so good.

Now we have to make the drill down operation on the last item automatic: when the uppermost chart is displayed then the detailed results of the last item shall be shown without any user interaction in the lower two charts.

Now you can see why did I write that if progress events contained each result items fields then this task could be - relatively - easily accomplished.

With best regards,
fjp2485

[VatsalJagani]

Hi @fjp2485,

Check if basesearch works in your case!! Result of basesearch can be further processed in child search in the dashboard.

<form>
  <search id="Base_Search">
       <query>index=_internal | head 1000</query>
       <earliest>-24h@h</earliest>
       <latest>now</latest>
   </search>
   <row>
       <panel>
            <table>
                 <search base="Base_Search>
                       <query></query>
                  </search>
            </table>
        </panel>
    </row>
    <row>
       <panel>
            <chart>
                 <search base="Base_Search>
                       <query>| timechart count</query>
                  </search>
            </chart>
        </panel>
     </row>
</form>

Here in this example, it first panel (table) shows the output of basesearch and second panel (chart) further process it and shows timechart.