Multi search Dashboard panel

[tkerr1357]

Hello,

I would like to make a dashboard panel that is a table the shows total successful logins in one row and total failed logins in another row. The base search for both is index=myindex Eventcode=4624(successful) host=myhost1 user=user* | stats count , index=myindex EventCode=4625(failed) host=myhost1 user=user* | stats count. Can anyone help me with how I would display these separate searches in a single dashboard panel?

[niketn]

@tkerr1357 don't introduce subsearch for the query as you can handle straightforward using a query like the following:

Eventcode=4624 ("successful" OR "failed") host=myhost1 user=user* 
| stats count(eval(searchmatch("successful"))) as successful  count(eval(searchmatch("failed"))) as failed

The above search will make single trip to fetch required data from Index and will not be impacted by subsearch limitation. Please try out and confirm! 

[impurush]

Hi @tkerr1357 

Use the append command to do that.

index=myindex Eventcode=4624(successful) host=myhost1 user=user* | stats count
|append [search index=myindex EventCode=4625(failed) host=myhost1 user=user* | stats count]