Splunk Search

What is the spl code to use the output of Panel_1 to other panels?

Jouman
Path Finder

Hi all,

I want to implement 2 panels in one dashboard.
Output of Panel_1 will be a list of ID that meet the search keyword and I hope to find a way to use the output as the input to Panel_2, Panel_3, and Panel_4. 
Panel_2, Panel_3, Panel_4 will use the list of ID to search but using different conditions. 

I can't find a way to make the output of Panel_1 as the input to the rest 3 Panels.

Is there any way to implement such purpose?

Moreover, is there any way to color each Panel into different color?

Thanks.

Labels (3)
0 Karma

woodcock
Esteemed Legend

Make the search from panel 1 a base search to drive all of the panels:
https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/Savedsearches

ITWhisperer
SplunkTrust
SplunkTrust

You could set up a base search which you display in panel 1 and then extend for the searches in the other panels.

0 Karma

Jouman
Path Finder

Thanks for the suggestion.

I think about this method. However, in the following Panel_2, Panel_3 and Panel_4, the search index and data are more than what Panel_1 can generated.
I found if I set Panel_1 as base_search, my Panel_2~Panel_4 are unable to execute since no sufficient index and data.
Is there any other method? 
Panel_1 is used to limit the input to Panel_2~4 while Panel_2~4 have each own condition to select the exact input from output of Panel_1.

Thanks.

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...