One search to source multiple dashboard tables

[skippylou]

Couldn't see to find a question like this here, but maybe my search for it is no good.

What I'd like to do is have a single search run, that could populate multiple tables in a dashboard.

As an example, say I have all my postfix mail logs in an index named 'mail'.

I want to have a dashboard with three panels, each populated with the output of the below three searches:

index=mail earliest=-24h | top client
index=mail earliest=-24h | top to
index=mail earliest=-24h | top from

Is there a way to get at the data by only running the search once and manipulating the top outputs, instead of taking the resource cost of running that three separate times (one for each top output needed)?

Thanks in advance,

Scott

[christopherutz · Accepted solution]

This is possible, take a look at http://www.splunk.com/base/Documentation/4.1.5/Developer/PostProcess.

[skippylou]

Fantastic, thanks!

Scott