Populate 2 panels from one search Dashboard?

[trever]

I have a search that pulls back a list of values and tables them for the details, what I would like to do is use that same search (so I don't have to run it twice since the base data is the same) and instead distinct count it so that I can have a count of what has came back for quick reference.

I.e. If I'm expecting 15 values, but only 10 have came back, then I can proceed from there. Or if I'm expecting 15 and 15 have came back I can stop the search since everything I was looking for has came back even though the time frame may be too wide.

How could I accomplish this in a dashboard?

[richgalloway · Accepted solution]

Yes, you can use one search in two (or more) dashboard panels. It's called "post-processing". First, you declare a base search, which collects events and (usually) transforms the data. Then each panel processes the results of the base search and displays it. See https://docs.splunk.com/Documentation/Splunk/8.0.3/Viz/Savedsearches#Post-process_searches_2 for more information.