Hello Everyone,
I am working on a dashboard with 2 event panel . and i would like to use the outcome of panel 1 as an input to my panel 2 . Can you please advise what is the optimal way to take a specific field output and utilise as an input in the next panel . I tried base search but did not provide result as expected.
Panel 1 :
<query>index=xyz sourcetype=vpn *session*
| fields session, connection_name, DNS, ip_subnet, Location,user
| stats values(connection_name) as connection, values(Dns) as DNS, by session
| join type=inner session
[ search index=abc sourcetype=vpn *Dynamic*
| fields assigned_ip,session | stats values(assigned_ip) as IP by session]
| table User,session,connection_name,ip_subnet,IP,DNS,Location |where user="$field1$" OR connection_name="$field2$" OR session="$field3$"</query>
Once the output is generated for the above query , i would like to leverage the value displayed for Ip_subnet and use that as input for panel 2
Panel 2:
<query>|inputlookup letest.csv
|rename "IP address details" as IP
| xyseries Ip_subnet,Location,IP | where Ip_subnet="$Ip_subnet$"</query>
In panel 2 $Ip_subnet$ is input that would be taken from value of Ip_subnet of panel 1.
Hello Richgalloway,
Thank you for taking time and responding to my query . Instead of using the set token i went ahead with storing the value in another field ( as a dropdown) and selected from there and that became the input for the next panel.
Regards.
Use a done element to set a token for the 2nd query to use.
...</query>
<done>
<set token=ip_subnet>$result.ip_subnet$</set>
</done>
Remember that field and token names are case-sensitive.
Hello Richgalloway,
Thank you for taking time and responding to my query . Instead of using the set token i went ahead with storing the value in another field ( as a dropdown) and selected from there and that became the input for the next panel.
Regards.