Greetings, I have a dashboard with 2 panels. The first panel uses a simple input for userid to fuel the search. index=foo sourcetype=bar $userid$
| table session This will return a varying number of session results depending on the time period specified. I want to take all the returned values and feed into a second panel search to show how many time a specific event occur for each session. index=foo sourcetype=bar eventtype=specific $sessionid$
| stats count AS Total by session I populate the token $sessionid$ with the following xml at the end of the first panel: <finalized>
<condition match=" 'job.resultCount' != 0">
<set token="sessionid">$result.session$</set>
</condition>
</finalized> My problem is, this will only return the first value from the first search. I need it to send all values of session to search by. For example if the first search return multiple lines with session values A1, B2, C3; I would like to format the token to produce this search: index=foo sourcetype=bar eventtype=specific session IN (A1,B2,C3)
| stats count AS Total by session Hopefully this is clear, let me know if it is not. Thanks!
... View more