Use query results from one panel as input to query on another panel on the same Dashboard

[nmulm]

Hi,

Sorry if I am duplicating question here but I could not find an answer in the other posts that matched my scenario.

So I have a number of inputs on my dashboard and two panels, the first panel results in a multi row table. I wish to use the values from one of the fields as an input to a second panel on the same dashboard. I am not sure if this is possible as I have read cases where only single results are passed in this way, is this correct?

Ideally I would like the first query to be complete before the second attempted to load, and I would like the data from the query1 field I am interested in like this ( val1 OR val2 .....), so I can then use a token to insert it into my second query. I've pasted a cut down version of the Dashboard to help where $results_tok_query1$ equates to ( val1 OR val2 .....) resulting form the first query.

Thanks,
N

<form script="refresh_button.js">
  <label>Transactions</label>
  <description>Filterable means to examine transactions</description>
  <fieldset submitButton="true" autoRun="true">
    <input type="time" token="global_time_tok">
      <label>Time</label>
      <default>
        <earliest>-4h@m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="multiselect" searchWhenChanged="false" token="global_host_tok">
      <label>Select Hosts</label>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>host=</valuePrefix>
      <delimiter> OR  </delimiter>
      <default>host1</default>
      <choice value="host1">host1</choice>
      <choice value="host2">host2</choice>    
      ..
      <choice value="host10">host10</choice>          
      <initialValue>host1</initialValue>
    </input>
    <input type="dropdown" token="global_duration_tok">
      <label>Completed Transaction Duration (secs)</label>
      <choice value="1">>1</choice>
      <choice value="5">>5</choice>
      <choice value="15">>15</choice>
      <choice value="30">>30</choice>
      <choice value="60">>60</choice>
      <choice value="300">>300</choice>
      <choice value="3600">>3600</choice>
      <default>15</default>
    </input>
    <input type="text" token="global_search_tok" searchWhenChanged="false">
      <label>Freeform Search</label>
      <default> </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Completed Transactions Info</title>
      <table>
        <search>
            <query>
                <my query1 here> |
                table _time Host_JVM MemIdNum Interaction Duration | 
                sort _time
            </query>
          <earliest>$global_time_tok.earliest$</earliest>
          <latest>$global_time_tok.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Completed Transactions Full Log</title>
      <event>
        <search>
            <query>
                <my query2 here $results_tok_query1$ |
                transaction myCid  | 
                where duration&gt;$global_duration_tok$ | search $global_search_tok$ | sort _time
            </query>
          <earliest>$global_time_tok.earliest$</earliest>
          <latest>$global_time_tok.latest$</latest>
        </search>
        <option name="type">list</option>
      </event>
    </panel>
  </row>  
</form>

[DalJeanis]

Here's the structure that works for me in one dashboard/form.

In the original design, the single search calculated field2 (which was a big chunk of a search) and then ran a map.

In the revised, two-search form, the first search creates the field2, then the second search runs it.

For whatever reason, this is WAY faster than the map version, and as a bonus, you can check the details in the index to see of exactly what the final search language was.

The order of the two panels is not important using simple XML. I put the "first" panel at the bottom because, for my use case, I didn't need to see the output, and in my live dash, not reflected below, the panel stays hidden. (If I recall correctly, when using sideview the order would have to be reversed.)

<form>
  <fieldset submitButton="true">

    ....various input fields including the one example here...

    <input type="text" token="userfield">
      <label>fieldname of user name field</label>
      <default>user</default>
    </input>

  </fieldset>

  <row>
    <panel depends="$field2$">
      <table>
        <search>
          <query>

   search 2 language here $field2$
   more search language here

          </query>
        </search>
      </table>
    </panel>
  </row>

  <row>
    <panel >
      <table>
        <search>
          <query>

      search language here using input field tokens like $userfield$ 
      more search language that calculates and populates field2
      | table field2

          </query>

          <finalized>
            <set token="field2">$result.field2$</set>
          </finalized>

        </search>
      </table>
    </panel>
  </row>
</form>

---

NOTE - the above is stripped down to the minimum necessary framework to achieve the result. The working parts are the <finalized> in the first search using the row 1 results to set the token for the second search.

[cmerriman]

I think what you might want to do is use post processing. This is a little bit of a complex post processing, as they're chained together, but i think it might work for what you're doing.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/Savedsearches#Post-process_searches_2

<form script="refresh_button.js">
   <label>Transactions</label>
   <description>Filterable means to examine transactions</description>
   <fieldset submitButton="true" autoRun="true">
     <input type="time" token="global_time_tok">
       <label>Time</label>
       <default>
         <earliest>-4h@m</earliest>
         <latest>now</latest>
       </default>
     </input>
     <input type="multiselect" searchWhenChanged="false" token="global_host_tok">
       <label>Select Hosts</label>
       <prefix>(</prefix>
       <suffix>)</suffix>
       <valuePrefix>host=</valuePrefix>
       <delimiter> OR  </delimiter>
       <default>host1</default>
       <choice value="host1">host1</choice>
       <choice value="host2">host2</choice>      
       ..
       <choice value="host10">host10</choice>            
       <initialValue>host1</initialValue>
     </input>
     <input type="dropdown" token="global_duration_tok">
       <label>Completed Transaction Duration (secs)</label>
       <choice value="1">>1</choice>
       <choice value="5">>5</choice>
       <choice value="15">>15</choice>
       <choice value="30">>30</choice>
       <choice value="60">>60</choice>
       <choice value="300">>300</choice>
       <choice value="3600">>3600</choice>
       <default>15</default>
     </input>
     <input type="text" token="global_search_tok" searchWhenChanged="false">
       <label>Freeform Search</label>
       <default> </default>
     </input>
   </fieldset>
   <search id="baseSearch">
      <query>
        <my query1 here> |
            table _time Host_JVM MemIdNum Interaction Duration | 
            sort _time
      </query>
        <earliest>$global_time_tok.earliest$</earliest>
        <latest>$global_time_tok.latest$</latest>
    </search>
    <search base="baseSearch" id="subBaseSearch">
      <query>
        |table interestingField|format
      </query>
        <earliest>$global_time_tok.earliest$</earliest>
        <latest>$global_time_tok.latest$</latest>
        <done><set token="results_tok_query1">$results.interestingField$</set></done>
    </search>
   <row>
     <panel>
       <title>Completed Transactions Info</title>
       <table>
         <search base="baseSearch">
             <query>
             </query>
           <earliest>$global_time_tok.earliest$</earliest>
           <latest>$global_time_tok.latest$</latest>
         </search>
       </table>
     </panel>
   </row>
   <row>
     <panel>
       <title>Completed Transactions Full Log</title>
       <event>
         <search>
             <query>
                 <my query2 here $results_tok_query1$ |
                 transaction myCid  | 
                 where duration>$global_duration_tok$ | search $global_search_tok$ | sort _time
             </query>
           <earliest>$global_time_tok.earliest$</earliest>
           <latest>$global_time_tok.latest$</latest>
         </search>
         <option name="type">list</option>
       </event>
     </panel>
   </row>  
 </form>