How can we do drilldown saved searches in splunk sideview.

[disha]

I have saved searches in my app. In human words my requirement is:
1. Save the search
2. save the next search
3. save the next search
4. Run the first search on scheduled time. Feed the output of first search to the second saved search with some additional new fields and run on its scheduled time.
5. check the output of second search and if condition met run the third search or run the script.
I am not able to figure out drill down of scheduled searches. Please help.
Thankyou.

[tmarlette]

This is usually done in advanced XML with $foo$ variables passing information on to the next table. The best way to learn about how to do this is with these two apps:

Sideview Utils (go to the sideview site to get this)
UI Examples for 4.1

Both apps do what you are asking for a bit differently, but sideview is the best for doing things like drilldown's with advanced XML. just go to the app and start browsing, and you will see all of the examples of how they are using the modules.

If you're not that good with advanced XML, the 'sideview editor' is a pretty descent GUI solution for XML coding in splunk.

[disha]

I want to give you one example as user select some fields from dropdown and save the search. then says check the output of first search everyday if memory size exceeds than total size ..run the second saved search with output memory size value and total memory size from static records and show the result in email.

[dart]

Can you clarify what you mean by 'Feed the output of first search to the second saved search with some additional new fields and run on its scheduled time'? What data and how do you want it filled in? Can you give an example? Why do you want to run multiple searches instead of one? What is your overall goal that you are trying to achieve? The reason I ask so many questions is my initial thought is that this would be better using subsearch or similar.