@bowesmana , yes, now I understood, and it worked, thank you so much for your patience. ... View more

@kamlesh_vaghela I want to thank you for all your help. you were right, it was the condition "<condition match="'result.count'!= &quot;0No event for this table&quot;">" It worked when I've changed the condition back as your suggestion and then, I've hidden all dashboards  with the second search WHEN there are no results. Thanks again. I really appreciate it.  ... View more

@kamlesh_vaghela I was using the condition "result.count'!= &quot;0&quot;" but, in the queries that there were no results found , the panel was showing the message : "Search is waiting for input" and I thought that it would be confusing for people to understand, so I've changed to 'result.count'!= &quot;0No event for this table&quot;" In theory, it would do the same, but in my panel it would show 'no result found' which is more understandable.     let me try to change back to result.count'!= &quot;0&quot; and try again ... View more

@kamlesh_vaghela , I created a new dashboard and copied this new code. I've created a new dashboard and copied your sample. Is that right?   ... View more

@niketn , Good Afternoon! sorry for asking you , but I have an issue in my dashboard in triggering a second search if the count of result of my first search  will be  != 0 .  I was passing by and I saw this post where you explain how to do that, but in fact,  in the solution... apparently once we set the token, the SECOND SEARCH will not run a second time if the FIRST SEARCH runs again.  Do you know How Can I get this around?   ... View more

@kamlesh_vaghela  let me know if you need something more, please? I dont have anything more in my dashboard than this. ... View more

@bowesmana , How are you? First, I want to thank you for helping me.  I think there is a misunderstanding here.  So, the issue here is HOW to run a SECOND search IF the results in the FIRST search is =! 0, right? However, in the example you gave me , you used my first search, instead of the SECOND. my first search is: index = my index sourcetype= my sourcetype action=Allowed [|inputlookup OTX | search type=URL | rename indicator as url | table url] |dedup user |stats count but , my SECOND search is:  index = my index sourcetype= my sourcetype action=Allowed [|inputlookup OTX | search type=URL | rename indicator as url | table url] |dedup user | table _time, url, user, serverip, ClientIP |sendemail to="myemail@domain.co.nz" server=smtp.server.co.nz subject="OTX -  Notification - IOC found by Domain" message="This is an test message" sendresults=true inline=true format=csv</set> What I dont know is HOW to trigger a second search , if the results of the first one is !=0 You said that I should add the token in the SECOND search, which makes sense, but then, I didnt understand HOW to trigger my second search using   eval token="trigger">if(isnull($trigger$),0,$trigger$+1)</eval> in your example, you used "stats count" in the 2 queries.    Can you clarify? I feeling ignorant, but I cant help it. so, I tried to get the main idea.  so, in your example,  ... View more

  @kamlesh_vaghela , this is the whole code for 2 searches (URL and Domain stats count  and their respective panel that shows the second search ).            <title>Hits by URL</title>         <search id="main_search1">           <query>index = xxx sourcetype=xxxx action=Allowed [|inputlookup OTX | search type=URL | rename indicator as url | table url] |dedup user |stats count</query>           <earliest>$time.earliest$</earliest>           <latest>$time.latest$</latest>           <refresh>3600s</refresh>           <done>             <condition match="'result.count'!= &quot;0No event for this table&quot;">               <set token="tkn_first_search"> index = xxx sourcetype=xxxx action=Allowed [|inputlookup OTX | search type=URL | rename indicator as url | table url] |dedup user | table _time, url, user, serverip, ClientIP |sendemail to="luciana.campos@Company.co.nz" server=smtp.Company.co.nz subject="OTX XXX Notification - IOC found by Domain" message="This is an test message" sendresults=true inline=true format=csv</set>             </condition>             <condition>               <unset token="tkn_first_search"></unset>             </condition>           </done>         </search>         <option name="colorMode">block</option>         <option name="drilldown">none</option>         <option name="rangeColors">["0x65a637","0xd93f3c"]</option>         <option name="rangeValues">[0]</option>         <option name="refresh.display">progressbar</option>         <option name="trellis.enabled">0</option>         <option name="underLabel">Domainyrl</option>         <option name="useColors">1</option>       </single>     </panel>     <panel>       <title>my title</title>       <single>         <title>Hits by Domain_Hostname</title>         <search id="main_search2">           <query>index = index = xxx sourcetype=xxxx action=Allowed [|inputlookup OTX | search type=domain OR type=hostname | rename indicator as hostname | table hostname] |dedup user |stats count</query>           <earliest>$time.earliest$</earliest>           <latest>$time.latest$</latest>           <refresh>3600s</refresh>           <done>             <condition match="'result.count'!= &quot;0No event for this table&quot;">               <set token="tkn_second_search"> index = xxx sourcetype=xxxx action=Allowed [|inputlookup OTX | search type=domain OR type=hostname | rename indicator as hostname | table hostname] |dedup user |table _time, hostname, domain, user, serverip, ClientIP |sendemail to="luciana.campos@Company.co.nz" server=smtp.Company.co.nz subject="OTX - XXX Notification - IOC found by Domain" message="This is an test message" sendresults=true inline=true format=csv</set>             </condition>             <condition>               <unset token="tkn_second_search"></unset>             </condition>           </done>         </search>         <option name="colorMode">block</option>         <option name="drilldown">none</option>         <option name="rangeColors">["0x65a637","0xd93f3c"]</option>         <option name="rangeValues">[0]</option>         <option name="refresh.display">progressbar</option>         <option name="trellis.enabled">0</option>         <option name="underLabel">Domainyrl</option>         <option name="useColors">1</option>       </single>     </panel>     <panel>       <title>Query 1</title>       <table>         <search>           <query>$tkn_first_search$</query>           <earliest>-4h@h</earliest>           <latest>now</latest>         </search>         <option name="dataOverlayMode">none</option>         <option name="drilldown">none</option>         <option name="percentagesRow">false</option>         <option name="refresh.display">progressbar</option>         <option name="rowNumbers">false</option>         <option name="totalsRow">false</option>         <option name="wrap">true</option>       </table>     </panel>   </row>   <row>     <panel>       <title>Query2</title>       <table>         <search>           <query>$tkn_second_search$</query>           <earliest>-4h@h</earliest>           <latest>now</latest>         </search>         <option name="dataOverlayMode">none</option>         <option name="drilldown">none</option>         <option name="percentagesRow">false</option>         <option name="refresh.display">progressbar</option>         <option name="rowNumbers">false</option>         <option name="totalsRow">false</option>         <option name="wrap">true</option>       </table>     </panel>   </row>   <row>     <panel>   ... View more

but, I am doing it: check below:   <search id="main_search1"> <query>index = my index sourcetype=my sourcetype action=Allowed [|inputlookup OTX | search type=URL | rename indicator as url | table url] |dedup user |stats count</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> <refresh>3600s</refresh> <done> <condition match="'result.count'!= &quot;0No event for this table&quot;"> <set token="tkn_first_search">index = my index sourcetype= my sourcetype action=Allowed [|inputlookup OTX | search type=URL | rename indicator as url | table url] |dedup user | table _time, url, user, serverip, ClientIP |sendemail to="myemail@domain.co.nz" server=smtp.server.co.nz subject="OTX -  Notification - IOC found by Domain" message="This is an test message" sendresults=true inline=true format=csv</set> </condition> <condition> <unset token="tkn_first_search"></unset> </condition> </done> </search> ... View more

Thanks @bowesmana  I understood and it worked, but in the end, I ended up showing the results from my SECOND search in the bottom panels, I've changed a little the condition match but, now is happening again what you had advised me about once I set the token, the search will not run a second time if the first search runs again 😞 and I dont know how to fix it, because I understood the issue but, I  might have not understood the logic. Would you mind to explain to me?   Check my code to be easier to understand: <search id="main_search1"> <query>index = my index sourcetype=my sourcetype action=Allowed [|inputlookup OTX | search type=URL | rename indicator as url | table url] |dedup user |stats count</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> <refresh>3600s</refresh> <done> <condition match="'result.count'!= &quot;0No event for this table&quot;"> <set token="tkn_first_search">index = my index sourcetype= my sourcetype action=Allowed [|inputlookup OTX | search type=URL | rename indicator as url | table url] |dedup user | table _time, url, user, serverip, ClientIP |sendemail to="myemail@domain.co.nz" server=smtp.server.co.nz subject="OTX -  Notification - IOC found by Domain" message="This is an test message" sendresults=true inline=true format=csv</set> </condition> <condition> <unset token="tkn_first_search"></unset> </condition> </done> </search> for example, the stats count that was in RED , now has changed to green, which means there are 0 IOCs found, but the bottom panel continues to show me the oldest result and sending me emails.   thanks  Luciana, feeling ignorant with Splunk ... View more

ok @kamlesh_vaghela  I will try to set different tokens. 🙂 Have you noticed that in the solution that you helped me has a little issue... once we set that token, the SECOND SEARCH will not run a second time if the FIRST SEARCH runs again? Do you know How Can I get this around?   for example, the stats count that was in RED changed to green, which means 0 IOCs found, but the bottom panel continues to show me the oldest result . ... View more

@kamlesh_vaghela  thanks for all your help and I swear that is my last message🙂  I've just changed the condition for : <condition match="'result.count'!= &quot;0No event for this table&quot;"> then it will show 'no results count. 🙂 now, I am trying to add all my query results in ONE panel. I was checking your answer in the following https://community.splunk.com/t5/Dashboards-Visualizations/How-to-add-two-query-results-in-xml-dashboard/m-p/446539 but,  I m not sure if I can use 2 different tokens (condition match that triggers my second query) and ($job.sid$) for the first query Can you just confirm?         ... View more

thanks @bowesmana  you helped me a lot!  🙂 Have a nice week ... View more

@kamlesh_vaghela  I hope you are having a good day! so, I've tried and it worked, now every time the first query has a result count > 0 the second search triggers and send an email 🙂  Can I confirm with you if I understood  right the idea of: result.count'!= &quot;0&quot;" ( in case there are no results >=0, then it will show no results found?) I thought about using the same logic for all queries in my dashboard, then, as for an example, I did a test in 3 queries , however in the query that we dont have any IOC is found (hits by URL - $tkn_first_search$) , it is appearing for me " search is waiting for input" not sure is this is associated or not.   ... View more

@bowesmana  thanks for your suggestion. I tried and  the token works perfectly I think I can adapt in my dashboard 🙂 Sorry, I got confused about the drilldown, now I understood that you had set the drilldown as 'none' 🙂  The only thing is , the second search will be exclusively for sending alerts with more info, so it will not be appearing in the dashboard, Is there a way to use the same logic but now show in the dashboard?.   ... View more

@bowesmana , thanks for your answer. I really appreciate. I will give a try in your suggestion, but I have a question: You said that I should add a token in the second  query, but in your dashboard you are adding a drilldown in the first query.   Was intentional or just an example? When I saw your model of dashboard I was in doubt how to integrate this in my current dashboard.  Please, let me explain better: I already have a dashboard that shows the status count.  I can't use the sendemail in the first query, because it only shows the number of IOCs found, but it does not give me any detail 😞   In my current dashboard,  I have  several searchs looking IOCs across different logs. However, the only way I found to use the second search was using a drilldown. so, if the USER clicks in the number (stats count - 1st query) , then the detailed information (second query) will appear in the last panel in the bottom.  As soon it appears there, then automatically the dashboard will send an email to me, but with my solution, I am always depending on SOMEONE click in the number in red.  I could not find a way to make the drilldown works independently , meaning, drilldown be activated with second query without ANYONE clicking, only obeying the condition bellow in the second query  ( <condition match="'click.value'!= 0">) Even adding a condition in drilldown I m always forced to CLICK. so annoying. Then, I thought: ok, I can have the stats number, I can have the drilldown, but I could additionally add my second query again after stats number and send the email alert for me.  You  can take a look in my dashboard and all the code in the link below Re: Splunk dashboard using drilldown showing detai... - Splunk Community   I am wonder if maybe the solution would be not using the drilldown.   Does it make sense more sense to you? ... View more

or in another words... How to trigger second search based on first search where condition is : first result count >=1 ... View more

Hi @kamlesh_vaghela , How are you? look, I am considering that I cant do what I want because drilldown always will be requiring that user clicks. but actually , what I want is IF the search stats count >=1 then, a second search would be trigger and then, in this search I could use the sendemail command to send me alert with more information   so, considering  first query: index = xxx sourcetype=xxx action=Allowed [|inputlookup OTX | search type=URL | rename indicator as url | table url] |dedup user |stats count    <condition match="$result.resultCount$>1"> then run a second query:  index = xxx sourcetype=xxx action=Allowed [|inputlookup OTX | search type=domain OR type=hostname | rename indicator as hostname | table hostname] |dedup user |table _time, hostname, domain, user, serverip, ClientIP |sendemail to="myemail.co.nz" server=smtp.server.co.nz subject="Notification - IOC found by url" message="This is an test message" sendresults=true inline=true format=csv   Do you know if is possible, or How Can I do this? I thought about set a token with  <condition match="$result.resultCount$>1"> but then , I dont know how to trigger a second search if the condition is true.   Thank you so much ... View more

Good Morning @kamlesh_vaghela Sorry, I didnt understand the idea. Why Have you sent me this sample dashboard? 🙂 Do you want that I fill out all queries from my old dashboard to this one? ... View more

Hello @kamlesh_vaghela , thanks for helping me! so,  you mean this:     ... View more

Hello @kamlesh_vaghela  thanks for replying me. so, I tried this, but I continue with the same problem which is that I have to CLICK in the number , in order to show me the details inside the 'Information Table' in the bottom.  I'd like the results would go there WITHOUT clicking if the count != 0 IF I add this condition here:   Besides I have to CLICK in the number to the results show up in the "information table' , what happened is when I click the SEARCH window opens to me 😞   ... View more