Hi All, how can i take result (which is a macro ) of inputlookup table and use that result to extract data from the macro ??

[Anantha123]

| inputlookup ED_ENDI_Digital_Flow
| search Flow="ED_ENDI_FLOW_"
| search Step="ED_ENDI_STEP"
| rex field=Step "ED_ENDI_STEP_(?\w+)"
| stats values(Title1) as titleVals
| eval hostFilter="(ED_ENDI_STEP_".mvjoin(titleVals, ") OR (ED_ENDI_STEP_").")"
| fields hostFilter

host filter will have list of macros as a result as below format

o/p - (macro1) OR ('macro2') OR (macro3) .....

I want value of hostFilter to be appeared in below query to use the values in these macros (results of hostFilters)

index=* ***(hostFilter macros i.e (macro1) OR ('macro2') OR (macro3) .... ) | stats count as Total

[Anantha123 · Accepted solution]

We can use Base search for Inputlookup query and link the result to Panel query by using data element

<query>

| inputlookup ED_ENDI_Digital_Flow
| search Flow="ED_ENDI_FLOW_"
| search Step="ED_ENDI_STEP"
| rex field=Step "ED_ENDI_STEP_(?\w+)"
| stats values(Title1) as titleVals
| eval hostFilter="(ED_ENDI_STEP_".mvjoin(titleVals, ") OR (ED_ENDI_STEP_").")"
| fields hostFilter

<earliest>$Time.earliest$</earliest>
<latest>$Time.latest$</latest>
<done>
  <set token="ABC">$result.finaldata$</set>
</done>

---

---

---

<panel>
  <table>
    <title>test $ABC$</title>
    <search>
      <query>index=* $ABC$ |stats  count AS Total </query>
      <earliest>$Time.earliest$</earliest>
      <latest>$Time.latest$</latest>
    </search>
    <option name="drilldown">none</option>
  </table>
</panel>

[richgalloway]

@Anantha123 Is your problem resolved? If so, please accept the answer to help future readers.

[Anantha123]

Yes, with above code. I am able to get the result of base search dragged in to the panel query