Coming from Splunk world and didn't found answer to this in the workbook documentation.
Is it possible to chains searches, like in Splunk, explained here:
https://docs.splunk.com/Documentation/Splunk/9.3.1/DashStudio/dsChain
Trying to explain in KQL terms: suppose there are 3 very similar queries, like
- same base search | condition 1
- same base search | condition 2
- same base search | condition 3
feeding 3 vizualizations.
Goal is to execute the "same base search" part only once in the workbook.
Defining a new function for "same base search" still means 3 executions, I guess.
Your response is appreciated.
Thank you.
