Splunk Inc.
Executing a child query based on results of a parent query

Abstract:

Systems and methods are disclosed for allowing a user to iteratively build a query. For example, a user interface (UI) data manager can obtain a child query entered or selected by a user. The child query may be a child query to a parent query, such that execution of the child query relies on the query results of the parent query. The UI data manager can associate an identifier corresponding to the query results of the parent query with the child query, and cause a data intake and query system to execute the second query using the identifier. The UI data manager can then instruct a client browser to display the query results provided by the data intake and query system in a graphical user interface (GUI) in an area separate from an area that displays the query results of the parent query.