Here is an enhanced version of the dashboard which performs the actions you described (more or less). <form version="1.1" theme="light">
<label>Token-driven repetition save</label>
<row>
<pa...
See more...
Here is an enhanced version of the dashboard which performs the actions you described (more or less). <form version="1.1" theme="light">
<label>Token-driven repetition save</label>
<row>
<panel>
<table>
<search>
<query>| makeresults format=csv data="field
value_1
value_2"
| stats count as counter</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<done>
<condition match="$result.counter$ > 1">
<eval token="current">if($result.counter$ > 0,$result.counter$,null())</eval>
<set token="trace"></set>
</condition>
<condition>
<set token="trace"></set>
<unset token="current"/>
</condition>
</done>
</search>
<option name="drilldown">none</option>
</table>
</panel>
<panel>
<table>
<search>
<query>| makeresults format=csv data="field
value_1
value_2"
| eval spl=case(field="value_1","| inputlookup test_2.csv | search NOT field=\""+field+"\" | outputlookup test_2.csv",
field="value_2", "| makeresults | eval field=\""+field+"\" | outputlookup append=t test_2.csv")</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
<row>
<panel>
<table>
<title>$current$</title>
<search>
<query>| makeresults format=csv data="field
value_1
value_2"
| eval spl=case(field="value_1","| inputlookup test_2.csv | search NOT field=\""+field+"\" | outputlookup test_2.csv",
field="value_2", "| makeresults | eval field=\""+field+"\" | outputlookup append=t test_2.csv")
| eval counter=$current$
| tail $current$
| reverse</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<done>
<condition match="$result.counter$ > 1">
<set token="spl">$result.spl$</set>
<eval token="current">if($result.counter$ > 1,$result.counter$-1,null())</eval>
</condition>
<condition>
<eval token="spl">if($result.counter$ > 0,$result.spl$,null())</eval>
<unset token="current"/>
</condition>
</done>
</search>
<option name="drilldown">none</option>
</table>
</panel>
<panel>
<table>
<search>
<query>$spl$</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<done>
<unset token="spl"></unset>
</done>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form>