Hi Everyone. I have a small dashboard whos purpose is rather simple: input information, when the submit button is clicked, the info will be appended to a lookup. But first, I want to simply display what the user inputs onto a table. However, the submit button is not working. Here is the dashboard code:   <form version="1.1" theme="dark"> <label>Anonomized Dash Name</label> <description>Anonomized Description.</description> <fieldset submitButton="true" autoRun="false"> <input type="text" token="username_token" searchWhenChanged="false"> <label>Username</label> </input> <input type="text" token="email_token" searchWhenChanged="false"> <label>Email</label> </input> <input type="text" token="phone_number_token" searchWhenChanged="false"> <label>Phone Number</label> </input> <input type="text" token="intel_date_token" searchWhenChanged="false"> <label>Intel Date</label> </input> <input type="text" token="ip_address_token" searchWhenChanged="false"> <label>IP Address</label> </input> <input type="text" token="EE_number_token" searchWhenChanged="false"> <label>EE_number</label> </input> <input type="text" token="mailiing_address_token" searchWhenChanged="false"> <label>Mailing Address</label> </input> <input type="text" token="ticket_number" searchWhenChanged="false"> <label>Ticket Number</label> </input> <input type="text" token="intel_type_token" searchWhenChanged="false"> <label>Intel Type</label> <default>ATO</default> </input> <input type="text" token="comments_token" searchWhenChanged="false"> <label>Comments</label> </input> </fieldset> <row> <panel> <table> <title>Results</title> <search> <query>| makeresults | eval username = "$username_token$" | eval callback_num = "$phone_number_token$" | eval email = "$email_token$" | eval intel_date = "$intel_date_token$" | eval src_ip = "$ip_address_token$" | eval "mailing address" = "$mailing_address_token$" | eval EE_number = "$EE_number_token$" | eval ph_num = "$phone_number_token$" | eval "Ticket Number" = "$ticket_number_token$" | eval Comments = "$comments_token$" | table username email EE_number callback_num ph_num intel_date src_ip "mailing address" "Ticket Number" Comments</query> <earliest>-24h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>     ... View more

I have 2 searches and I want to link 2 together in one table. The first search:   index=very_big_index caseNumber=1234567799 | table _time Name caseNumber UID phone.   This displays the following as expected, but the phone field is blank: _time Name caseNumber UID phone 11APR2022 John Smith 1234567799 111222333444555666777     The second search with the UID yields the phone number but nothing else:   index=very_big_index 111222333444555666777 | stats values(phone) as phone   results: phone 123-555-1234   How can I efficiently link these 2 searches together using the common field name/value of UID/111222333444555666777 ... View more

Hello everyone, hope you are all well this afternoon. I am trying to combine 2 searches where the outer search passes a value to the inner search and then appends the results. Let me explain: As of right now, I am searching a set of logs that happens to include people's names and their request type when they call the bank. The one I am focused on is "withdraw inquiry." So we get a list of all people who try to withdraw money based on the following  base search. index=myIndex sourcetype=mySource request_type="withdraw inquiry" | xmlkv DetailXML | stats count, values(phone_number), values(activity_summary), values(request_type) values(email) by acct_num name_last name_first | where count > 1 | sort - count I have made this into a dash board and then subsequently added a drilldown. You click the panel and it then searches a lookup table called Previously_Compromised_Accounts.csv That search is this: | inputlookup Previously_Compromised_Accounts.csv | search name=*$clickValue$* | table date user How can I combine this search? Basically, I would like to add another column "compromisedUser" to the base search. If the base search is ran, then a secondary search would be performed, using the value of "name_last" and search the lookup table, which then appends the results to the base search as "compromisedUser" if no results come from the search of the Previously_Compromised_Accounts.csv, then that 8th coloumn can remain blank.    accountNumber name_first name_last call count values(phone_number) values(activity_summary) values(email) compromisedUser 123456678 Smith John 3 1235550987 withdraw inquiry JohnSmith@company.com 26DEC2021 jsmith001 ... View more