Creating a dashboard that allows you to select a region which will then retrieve data for only customers in that region. Each customer has their own "index" and the index name is the customer name. I'd like to avoid a subsearch as it's limited to 10k rows, you can subsearch the lookup though. The region isn't included in the customer index data.
------------------------------
Lookup data set:
Region | Customer
US1 Mcdonalds
US2 Macys
AU1 Atlassian
AU2 Outback
------------------------------
The issue I have run into is when I retrieve the list of customer names from the lookup, the subsearch is limited to 10k rows, there are a ton more rows that need to be included. I created a very inefficient query which I'm unhappy about, hence why I'm here:
index="*" [inputlookup CSS_Customers where Region = $inputregion$ | fields Customer | rename Customer as index] Note: I tried tstats to pull a single field, but ran into an index issue. It could be because our "index" field isn't indexed.
... View more