As a part of my dashboard, I get the results from a base search and join them in a different search in the panel.
In order to do this, I have created a token for the job id and I load the job in the panel when I am doing a join.
Base search
<search id="base_search">
<query>
<done>
<condition>
<set token="base_search">$job.sid$</set>
</condition>
</done>
</search>
in my panel, I use this base search as a part of the query join
<query>
search sourcetype="ABC"
|join type=left
[| loadjob $base_search$
]
|stats ...
</query>
When the dashboard is refreshed, the token still refers to the old job sid. I would like to know if there is a way to unset the token so that the base query will run again and the token is populated with the current base search result.
@kunwarjit by dashboard refresh do you mean using Refresh in the Browser or Refresh option in the dashboard for example refresh="500" or refresh within search?