Forum Discussion

Marek Stelcik's avatar
Marek Stelcik
Copper Contributor
Aug 22, 2023

Sentinel workbook: reusing outcome in multiple charts

Hello,

I wanted to ask for your help.

i have resource intensive query to do filtering and parisng. Then I would like to do some simple visualisation.

 

let data= materialize (Syslog
where TimeGenerated {TimeRange}
where HostName has "172."
extend Protocol = extract(@'protocol=\"?(\w+)\"?'1, SyslogMessage),
and much more.....
 
 
Is it possible to declare this somehow as global variable for whole sentinel workbook so I can subseqently just do something simple subselects and visualise?

like chart calling data and selectign one column
then visualising another colum etc.
for example:
data
summarize count() by  Src_IP
 
Problem i Have if I have to duplicate the whole first query where I am materiazing "data" in each chart its extremely slow.
 
 

Resources