How to sync two panels with different searches?

[yvassilyeva]

Hi! I have a dashboard with two panels where searches and fields are different. For example:

One panel has a search 

index=example sourcetype=abc |table field1 field2 field3

Another panel has a search 

index=example sourcetype=xyz |table field1 somethingElse

What I would like to do is to have a text input for field2 in the first panel. And then populate the second panel with the values for somethingElse and field1 where field1 values match that from the first panel.

Sorry for this example, but my search is too long and complex. Thank you very much!

[niketn]

For second panel try the following search where $tokField2$ is the field2 token value from the text box in first panel.

index=example sourcetype=xyz 
    [| search index=example sourcetype=abc field2="$tokField2$" 
    | table field1] 
| table field1 somethingElse

[yvassilyeva]

I cannot make it work for some reason. I will share the code with you, maybe there is something i am missing.

Here is my fist panel:  

index=migration sourcetype=source7                                                                                                                                          |table "Tandem CLLI" LATA "End Office"  "End Office Company Name"   | search "Tandem CLLI"="$tandemtoken$" "End Office"="$endofficetoken$"

And here is my second panel:

index=migration sourcetype=source6   NPA=$npatoken$ NXX="$nxxtoken$"
| table "End Office" SHA Status Effective_Date NPA NXX   |search "End Office"="$endofficetoken$"

So both panels have "End Office" as a common field. I have text input for NPA and NXX that populates the second panel (that's where the fields are). I want the first panel to autopopulate with the results for "End Office" that are displayed in the second panel when NPA or NXX were put in.  Please let me know if i explained it well. Thank you very much for your time and help!

[niketn]

@yvassilyeva First off, filter should be applied in search as early as possible. In your case in the same pipe as index. So your panel 1 query should be something like the following:

index=migration sourcetype=source7 "Tandem CLLI"="$tandemtoken$" 
    [| search index=migration sourcetype=source6 PA=$npatoken$ NXX="$nxxtoken$" "End Office"="$endofficetoken$" 
    | stats count by "End Office"
    | fields "End Office"] 
| table "Tandem CLLI" LATA "End Office" "End Office Company Name"

Also, if you want Panel 1 results to be populated based on "End Office" values returned by the second panel, then does it mean Panel 1 must wait 2nd panel search to complete and give all possible End Office names?

[yvassilyeva]

If it requires for second panel to populate, and then autopopulate the first panel, then yes. I tried the code you shared and my first panel doesn't return values based on the "End Office". When i chose 201 in the NPA input, my second panel populated with a few results for "End Office", but the first panel returned the same result as before (not the same values for End Office as in the second panel)...

[niketn]

@yvassilyeva I think it is difficult to capture your exact use case, problem and data. Please add more details if you can with sample data, current behavior and expected behavior (screenshots). If you notice I just have moved your second panel SPL to first panel base search as a sub-search, which returns only End Offices. So it is supposed to work as per requirement you have mentioned. So please add as much details and screenshots, sample data as possible. Please mock/anonymize any sensitive information before posting.

[yvassilyeva]

@niketn, here is a screenshot of the dashboard with two panels and some inputs:

I then enter a value of 201 into my NPA input, and the second panel populates with the values for 201 in the NPA field:

The values that i have for End Office in the second value should be the values for End Office in my first panel, but they do not..

[niketn]

@yvassilyeva try the following run any where example based on screenshot and data provided by you (It is always advisable to mask/anonymize any sensitive information before posting on Splunk Answers).

While subsearch approach should also work, instead of running an additional search I have used Post Processing in an independent search which sets the list of available End Office as the token to be passed to the search query for Panel 1.

Dummy query creates End Office as ABC001,DEF001,GHI001,JKL001, where as the Panel1 query has AAA001, BBB001, ABC001, GHI001 and ZZZ001. So filter should work and show results only based on Panel 2 End Offices. Text Box filter for End Office is applied for Panel 2 and Panel 2 End Office list is applied to Panel 1 as filter.

PS: As first answer, for better query performance, do re-organize your Search to ensure filters happen while pulling data from index.  

<form>
  <label>Pass Value from one Panel to Another</label>
  <!-- Independent Search to fetch the End Office list from Panel 2 and pass as token to panel 1 -->
  <search base="bMainData">
    <query>| stats values("End Office") as "End Office"
    | eval "End Office"="\"".mvjoin('End Office',"\",\"")."\""
    </query>
    <done>
      <set token="tokFilterOffice">$result.End Office$</set>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="text" token="tandemtoken" searchWhenChanged="true">
      <label>Tandem CLLI</label>
      <default>*</default>
    </input>
    <input type="text" token="endofficetoken" searchWhenChanged="true">
      <label>End Office</label>
      <default>*</default>
    </input>
    <input type="text" token="npatoken" searchWhenChanged="true">
      <label>Enter NPA</label>
      <default>*</default>
    </input>
    <input type="text" token="nxxtoken" searchWhenChanged="true">
      <label>Enter NXX</label>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>LERG1 LERG7 LERG 7 SHA (tokFilterOffice: $tokFilterOffice$)</title>
      <table depends="$tokFilterOffice$">
        <search>
          <query>| makeresults
| eval data="AAA001T,500,AAA001,Some Description 1;BBB001T,500,BBB001,Some Description 2;ABC001T,500,ABC001,Some Description 3;GHI001T,500,GHI001,Some Description 4;ZZZ001T,500,ZZZ001,Some Description 5;GHI001T,500,GHI001,Some Description 6;"
| makemv data delim=";"
| mvexpand data
| makemv data delim=","
| eval "Tandem CLLI"=mvindex(data,0),LATA=mvindex(data,1),"End Office"=mvindex(data,2),"End Office Company Name"=mvindex(data,3)
| table "Tandem CLLI" LATA "End Office" "End Office Company Name"
| search "Tandem CLLI"="$tandemtoken$" "End Office" IN ("$tokFilterOffice$")</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <title>LERG 6</title>
      <table>
        <search id="bMainData">
          <query>| makeresults
| eval data="ABC001,01, , ,262,287;DEF001,03, , ,262,285;GHI001,00, , ,262,281;JKL001,01, , ,262,278;"
| makemv data delim=";"
| mvexpand data
| makemv data delim=","
| eval "End Office"=mvindex(data,0),SHA=mvindex(data,1),Status=mvindex(data,2),Effective_Date=mvindex(data,3),NPA=mvindex(data,4),NXX=mvindex(data,5)
| table "End Office" SHA Status Effective_Date NPA NXX
| search  NPA=$npatoken$ NXX="$nxxtoken$" "End Office"="$endofficetoken$"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

 
Do up vote the answers that helped!

[niketn · Accepted solution]

@yvassilyeva If your issue is resolved, please accept the answer.

[yvassilyeva]

Unfortunately it didn't work. I'm still to figure it out because of the complicated search. Thank you!