Couldn't see to find a question like this here, but maybe my search for it is no good.
What I'd like to do is have a single search run, that could populate multiple tables in a dashboard.
As an example, say I have all my postfix mail logs in an index named 'mail'.
I want to have a dashboard with three panels, each populated with the output of the below three searches:
index=mail earliest=-24h | top client index=mail earliest=-24h | top to index=mail earliest=-24h | top from
Is there a way to get at the data by only running the search once and manipulating the top outputs, instead of taking the resource cost of running that three separate times (one for each top output needed)?
Thanks in advance,