Question on transformation commands

[prettysunshinez]

Hi All,

I need your helping in writing post process & base searches..
My dashboard requires a chart command in the first panel..
So having the post process search as below in first panel,I'm unable to write the base searches in the following panels which requires stats,table and sometimes raw data in them..

1st panel :
Search id = "base"

Query - index = source= | regex field1 | regex field2 | chart count over field1 by field2

2nd panel:
I wanted to perform stats count by field 1

3rd panel :
I want to display the raw events for the select value of field1 from the above panel

4th panel :
I want to display stats count by field x

Please suggest me how can i proceed with it.
Will i be able to use streamstats or eventstats in the first panel or is there any other suggestions for this.

Thanks in advance.

[prettysunshinez]

Any suggestions pls

[richgalloway]

Make panel 3 your base search using index = source= | regex field1 | regex field2. The other panels reference the base search and add their respective transformations.

[prettysunshinez]

@richgalloway I would not be able to do that because panel 3 query carries a token of field1 value from Panel 2(cell drilldown)

[richgalloway]

Create your base search before the first panel (not in a row). Be aware that this type of base search has limitations. See https://docs.splunk.com/Documentation/Splunk/8.0.3/Viz/Savedsearches#Post-process_searches_2.

<search id="myBaseSearch">
  <query>index= source= | regex field1 | regex field2</query>
</search>
<row>...