I understood why it happened. Thank you a lot ... View more

So that's a completely different problem. It's not about search as such but about the fact that when you're running a realtime search the results are indeed being updated as the search progresses. That's "by design". As @ITWhisperer already pointed out, real-time searches are not supposed to be used often. In fact, it's best to avoid them altogether (there are very few use cases when they are indeed justified). With a normal historical ad-hoc search, ever run of your search will produce a set of results which will be passed to your command which calls external IP and that's it. But remember that if you have a refresh set on your dashboard, every time the dashboard refreshes, the search will get re-run however so your API calls will be performed again. That's simply how it works 🙂 ... View more

Hi IT Whisperer, you are the best !!! Great was just what I needed and I couldn't do. Thank you so much for your great help. ... View more

Or you can try this: baseSearch | rex field=_raw "\suserId\=(?<userId>.*?)\s\," ... View more

Thank you, because it's  streaming command, so i need to but things back to the result. And I found the way 😄 thanks. ... View more

Please create a new unsolved question, then you will get much easier a solution to it. ... View more

It didn't work, but I tried with    <row depends="$showDownloadDetail$"> <panel> <table depends="$ipDownload$"> <title>Top Host Download from $ipDownload$</title> <search> <query>index=... | search SrcIP="$ipDownload$" | stats sum(DownSize) as Download by DstIP Client AppProtocol | sort 10 -Size | table DstIP, Client, AppProtocol, Download </query> <earliest>$early$</earliest> <latest>$late$</latest> <sampleRatio>1</sampleRatio> </search> </table> </panel>   So it worked perfectly. And we can remove the <eval> in drilldown, then call the token directly from <done>. By the way, i don't know how to find something like <done> tag, could you send me some docs about this. ... View more

Can you show your search which produced these results? ... View more

Hi Sundareshr, i got this problem, i want to add value 1 to 2 and remove the Shift0, do you have any solution? Thanks ... View more

Thanks for your helping. But I just solved the problem, and I found that I can't use this search in real-time. I tried your solution, it's still not work too.   ... View more