Hello All,
Is there a way to put a base search in the first dashboard which drilldowns to a new dashboard where it uses the base search from the first dashboard.
@Nadhiya123, how many base searches are being passed from one dashboard to another? What may vary in your base searches. Can you give examples of base search from first dashboard?
There is one search which i use to display a map in my first dashboard.
it drilldowns to the new next dashboard based on the lat/lon,
base search in 1st map dashbaord:
......
.......| stats max("count(xx)") as sessions, max(upperBound) as X, max(lowerBound) as Y by NPANXX,LAT,LNG
| geostats max(sessions) as sessions, max(X) as X, max(Y) as Y latfield=LAT longfield=LNG outputlatfield=LAT outputlongfield=LNG globallimit=0 | eval High_No_Of_Calls = if(sessions > $HIGH$,sessions,0)
| eval Medium_No_Of_Calls = if((sessions > $Medium$ AND sessions < $HIGH$ ),sessions,0) | eval Normal_No_Of_Calls = if(sessions <= $Medium$,sessions,0)
| fields - sessions, X, Y
drilldown search 1:
.........
......| stats max("count(xx)") as sessions, max(upperBound) as X, max(lowerBound) as Y by NPANXX,LAT,LNG | eval High_No_Of_Calls = if(sessions > $HIGH$,sessions,0)
| eval Medium_No_Of_Calls = if((sessions > $Medium$ AND sessions < $HIGH$ ),sessions,0) | eval Normal_No_Of_Calls = if(sessions <=$Medium$,sessions,0) | fields - sessions, X, Y| where LAT>=$lattitude1$ AND LAT<$lattitude2$ AND LNG>=$longitude1$ AND LNG<$longitude2$|table NPANXX,High_No_Of_Calls,Medium_No_Of_Calls,Normal_No_Of_Calls|where (High_No_Of_Calls=$High$ AND Medium_No_Of_Calls=$Med$ AND Normal_No_Of_Calls=$Normal$) |head 1|eval High_No_Of_Calls=$High$|eval Medium_No_Of_Calls=$Med$|eval Normal_No_Of_Calls=$Normal$|table NPANXX,High_No_Of_Calls,Medium_No_Of_Calls,Normal_No_Of_Calls
drilldownsearch 2:
| eventstats max("count(xx)") as sessions, max(upperBound) as X, max(lowerBound) as Y by NPANXX,LAT,LNG | eval High_No_Of_Calls = if(sessions >$HIGH$,sessions,0)
| eval Medium_No_Of_Calls = if((sessions > $Medium$ AND sessions < $HIGH$ ),sessions,0) | eval Normal_No_Of_Calls = if(sessions <=$Medium$,sessions,0) | fields - sessions, X, Y| where LAT>=$lattitude1$ AND LAT<$lattitude2$ AND LNG>=$longitude1$ AND LNG<$longitude2$
|table _time,....|where (High_No_Of_Calls=$High$ AND Medium_No_Of_Calls=$Med$ AND Normal_No_Of_Calls=$Normal$) OR (Medium_No_Of_Calls=$Med$ AND Normal_No_Of_Calls=$Normal$)|sort - _time|eval m=max($High$,$Med$,$Normal$) | streamstats c | where c<=m|table ....
Trying to work on the performance issue.
Thanks
Hi Nadhiya123,
you can pass as token a search from the first dashboard to the second but only if it's not so long because there are limits to url lenght.
Anyway do you want to pass a fixed search or a different one depending by the click on the first dashboard panel?
Maybe you could create secondary dashboard search passing as token only parameters.
Bye.
Giuseppe