Base search in Dashboard panel

[jeffbat]

I have a panel in a dashboard which is a search with 2 sub searches joined together. All of them are based off of the same starting criteria. Is there a way that I can have that starting search criteria used in each part of that search?

The data would be something like this:

Panel data:
| other manipulation steps | join sessionId [ search | different manipulation steps] | join sessionId [ search | different manipulation steps] | steps done on the combined data

Is this possible to do?

[jeffbat]

This is the query:

index=main sourcetype=UserAccount logger="App.ResetPassword" properties.event_id IN (3000,3001,3002) 
| rename message as user_message,  properties.sessionId as sessionId, properties.event_id as user_event_id, properties.userName as userName
| eval user_status = case(user_event_id=="3000","USER_OK",user_event_id=="3001","USER_NOT_FOUND", user_event_id=="3002", "USER_NOT_ELIGIBLE",1==1, start_event_id) 
| join type=left sessionId
[ search
    index=main sourcetype=UserAccount logger="App.ResetPassword" properties.event_id IN (3010,3011) 
    | rename properties.sessionId as sessionId, message as challenge_message, properties.event_id as challenge_event_id
    | eval challenge_status = case(challenge_event_id=="3010","CHALLENGES_OK",challenge_event_id=="3011","CHALLENGES_FAILED", 1==1, end_event_id)
    | fields sessionId, challenge_status, challenge_message
]
| join type=left sessionId
[ search
    index=main sourcetype=UserAccount logger="App.ResetPassword" properties.event_id IN (3050) 
    | rename properties.sessionId as sessionId, message as password_message
    | eval password_status = case(level=="INFO","PASSWORD_OK",level=="WARN", "PASSWORD_FAIL",1==1, level)
    | fields sessionId, password_status, password_message
]
| eval displayMessage = coalesce(password_message, challenge_message,user_message)
| eval displayStatus = coalesce(password_status,challenge_status,user_status)
| table _time,userName, displayStatus, displayMessage, sessionId, user_status, challenge_status, password_status

The reason for searching the same data set slightly differently is needing to change some of the fields around and then getting them all to merge correctly. I figured away to do the renames of the fields based on some IF statements but couldn't get everything to merge up together right as the JOIN function is doing (since there are multiple entries with the same sessionId and they end up on separate lines if I do this outside of using JOINs.

If i was able to get it to lay out and merge correctly in a single query without the JOINs then I could get a base search created.

Otherwise back to my original question of is it possible to use the base search in each part of a search query that has subsearches.

Thanks.

[sandeepmakkena]

Can you share your search query?