Hi All,
If I already have results that are saved in a report, is there any way to further filter down these results in a dashboard?
It's kind of like a data model where the report is the parent search and I want to create a bunch of children searches based off those results, rather than running separate reports for each children search.
Thanks!
Hi wills2g,
a report is a closed object so you cannot filter it as a data model.
The way to do what you want is to use a data model or a summary (see collect command at http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Collect ) that you can filter.
Bye.
Giuseppe
Hi wills2g,
a report is a closed object so you cannot filter it as a data model.
The way to do what you want is to use a data model or a summary (see collect command at http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Collect ) that you can filter.
Bye.
Giuseppe