Splunk Search

What is the spl code to use the output of Panel_1 to other panels?

Jouman
Path Finder

Hi all,

I want to implement 2 panels in one dashboard.
Output of Panel_1 will be a list of ID that meet the search keyword and I hope to find a way to use the output as the input to Panel_2, Panel_3, and Panel_4. 
Panel_2, Panel_3, Panel_4 will use the list of ID to search but using different conditions. 

I can't find a way to make the output of Panel_1 as the input to the rest 3 Panels.

Is there any way to implement such purpose?

Moreover, is there any way to color each Panel into different color?

Thanks.

Labels (3)
0 Karma

woodcock
Esteemed Legend

Make the search from panel 1 a base search to drive all of the panels:
https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/Savedsearches

ITWhisperer
SplunkTrust
SplunkTrust

You could set up a base search which you display in panel 1 and then extend for the searches in the other panels.

0 Karma

Jouman
Path Finder

Thanks for the suggestion.

I think about this method. However, in the following Panel_2, Panel_3 and Panel_4, the search index and data are more than what Panel_1 can generated.
I found if I set Panel_1 as base_search, my Panel_2~Panel_4 are unable to execute since no sufficient index and data.
Is there any other method? 
Panel_1 is used to limit the input to Panel_2~4 while Panel_2~4 have each own condition to select the exact input from output of Panel_1.

Thanks.

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...