How to pass multiple values between panels via tokens on dashboard?

[cdusseau]

Greetings,

I have a dashboard with 2 panels. The first panel uses a simple input for userid to fuel the search.

index=foo sourcetype=bar $userid$ 
| table session

This will return a varying number of session results depending on the time period specified. I want to take all the returned values and feed into a second panel search to show how many time a specific event occur for each session.

index=foo sourcetype=bar eventtype=specific $sessionid$ 
| stats count AS Total by session

I populate the token $sessionid$ with the following xml at the end of the first panel:

<finalized>
  <condition match=" 'job.resultCount' != 0">
    <set token="sessionid">$result.session$</set>
  </condition>
</finalized>

My problem is, this will only return the first value from the first search. I need it to send all values of session to search by.

For example if the first search return multiple lines with session values A1, B2, C3; I would like to format the token to produce this search:

index=foo sourcetype=bar eventtype=specific session IN (A1,B2,C3) 
| stats count AS Total by session

Hopefully this is clear, let me know if it is not. Thanks!

[VatsalJagani · Accepted solution]

@cdusseau - You need a middle search to make all sessions in a single value as you cannot pass multiple values with $result.<field>$ token.

index=foo sourcetype=bar $userid$ | table session 
| stats values(session) as sessions
| eval sessions=mvjoin(sessions, "\", \"")
| eval sessions="(\"".sessions."\")"

Then you can use the job.result in the same way

<finalized>
  <condition match=" 'job.resultCount' != 0">
    <set token="sessionids">$result.sessions$</set>
  </condition>
</finalized>

Then you can write the search token like this:

index=foo sourcetype=bar eventtype=specific session IN $sessionIds$ | stats count AS Total by session

I hope this helps!!!

[cdusseau]

Exactly what was needed! Thanks!

I will note that for some reason it had no results until I split the eventtype search into it's own line.

index=foo sourcetype=bar session IN $sessionIds$
| search eventtype=specific
| stats count AS Total by session