Hello @ITWhisperer , I would like to pass based search to panels in dashboard <search id="base_search_1">
<query>
index=$siteid$ sourcetype=log* values IN (Ax01, Ms09)
.....
| table *
...
See more...
Hello @ITWhisperer , I would like to pass based search to panels in dashboard <search id="base_search_1">
<query>
index=$siteid$ sourcetype=log* values IN (Ax01, Ms09)
.....
| table *
</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
</search>
<search id="base_search_2">
<query>
index=$siteid$ sourcetype=log* Values IN (*)
.....
| table *
</query>
<earliest>$time_token.earliest$</earliest> I need to pass base_search_1 when a inut drodpown is selected with "All", when other values are selected in the input dropdown, it need to pass base_search_2 to the panel in dashboard. thanks! <latest>$time_token.latest$</latest> </search> the reason why i choose this is, Actually we are having a input dropdown field which may be empty at some time also we are filtering only head 10000 records as per need, So when the input dropdown field is selected with "All" values, we don't have any issues either the field can be with values or can be empty but when the inputdropdown field is having spome field values to be filtered then empty field should not be giving proper results, so instead of head 10000, we need to filter non empty values of 10k, rather than head 10k, also please suggest other possible efiicient way to do this. thanks!