How to compare two columns in two different table panels, and show the matching values in a different panel?

[bharathkumarnec]

Hello,

I have two different panels in a dashboard and the common field is a time field. I need to compare these two time fields, and if they match, I want to show the same matching values in a different panel.

Your inputs will help me a lot!

Thanks in advance!

[lguinn2 · Accepted solution]

As @somesoni2 said, you can't actually compare across panels in a dashboard. But you could create a third panel, with this search

index=xyz host=abc (condition1) OR (condition2) 
| eval commonTime = coalesce(rtime,stime)
| stats values(def) as DEF values(ghi) AS GHI by commonTime
| where isnotull(DEF) AND isnotnull(GHI)

Note that the above search requires an exact match of the time fields. Often, times may vary by as much as a few seconds and still be considered a match. If this is true in your case, you might want to use the the bin command to "round" the time. To "round" to the second, insert the following as the third command in the sequence:

| bin span=1s commonTime

[bharathkumarnec]

Thanks a lot lguinn, it is very helpful!

[somesoni2]

How about using search for both the panels to populate 3rd panel? As far as I know, for simple xml, results for one panel can't be accessed in other panel. Could you post your current query ?

[bharathkumarnec]

Thanks for your reply:

First Panel Query : index=xyz host=abc condition1 | table rtime,def
Second Panel Query : index=xyz host=abc condition2 | table stime,ghi

I need to comparre rtime and stime from two panels and project common values in third panel.