I have a dashboard with many panel that use the same global search "my search_1", and each panel have an own query like " timechart count(field).." or "table field1".
When I click on a value on the chart, the drilldown give me all the output of global query "my_search1" missing the other part of query "timechart......" or "table fied1"
I look on the drilldown documentation but I don't found anything about the "search base=" o something like that.
Can anyone help me with this issue?
My_search1
.....
<query>
sourcetype="WinEventLog:Security" $field2$ EventCode="627" OR EventCode="628" OR EventCode="642" OR EventCode="644" OR EventCode="671" OR EventCode="685" OR EventCode="4723" OR EventCode="4724" OR EventCode="4738" OR EventCode="4740" OR EventCode="4767" OR EventCode="4781" OR EventCode="624" OR EventCode="626" OR EventCode="632" OR EventCode="636" OR EventCode="660" OR EventCode="4720" OR EventCode="4722 "OR EventCode="4728" OR EventCode="4732" OR EventCode="4756" OR EventCode="629" OR EventCode="630" OR EventCode="633" OR EventCode="634" OR EventCode="637" OR EventCode="638" OR EventCode="661" OR EventCode="662" OR EventCode="4725" OR EventCode="4726" OR EventCode="4729" OR EventCode="4730" OR EventCode="4733" OR EventCode="4734" OR EventCode="4757" OR EventCode="4758" OR EventCode="626" OR EventCode="4722" OR EventCode="629" OR EventCode="4725" OR EventCode="644" OR EventCode="4740" OR EventCode="671" OR EventCode="4767" $Business$| search NOT (Source_AccountName="*$" AND Target_AccountName="-")
..........
panel search
......
<search base="my_search1">
<query>|timechart count(eval(EventCode="644" OR EventCode="4740")) AS acc_locked,count(eval(EventCode="671" OR EventCode="4767")) AS acc_unlocked</query>
</search>
......
... View more