How to set single token with multiple values

[gvnd]

Hi,
My condition is::
I have following query in one panel;
Query 1::index="_internal" sourcetype=splunkd | table source | dedup source

result 1:: /opt/splunk/var/log/splunk/splunkd.log
/opt/splunk/var/log/splunk/metrics.log

Now I want to set a token for above result.

$result.source$>

Query2: index="_internal" sourcetype=splunkd source=$sourcefiles$ | table source | dedup source
result2: /opt/splunk/var/log/splunk/splunkd.log

My requirement is that I want both the results of first query in the same token value.

Thanks in advance.

[niketn]

@gvnd can you please throw some light to your use case as well? Above example seems to be doing the same task in both the Searches. One that passes source value is also performing a dedup and once you supply the same to base query to second search again you are trying to perform dedup.

However, if you really want to use the values of a search within the base query of main search as far as it generates a field already present in the main search, you can try the following:

index="_internal" sourcetype=splunkd [search index="_internal" sourcetype=splunkd | table source | dedup source]
| table source 
| dedup source

[gcusello]

HI gvnd,
only one information: from first panel do you want to drilldown in another panel/form passing all the results?

In the second panel you could use the first search as a subsearch:

index="_internal" sourcetype=splunkd [ search index="_internal" sourcetype=splunkd | dedup source | table source  ] 
| dedup source
| table source 

Bye.
Giuseppe