Coming from Splunk world and didn’t found answer to this in the workbook documentation.

Is it possible to chains searches, like in Splunk, explained here:

https://docs.splunk.com/Documentation/Splunk/9.3.1/DashStudio/dsChain

Trying to explain in KQL terms: suppose there are 3 very similar queries, like

same base search | condition 1same base search | condition 2same base search | condition 3

feeding 3 vizualizations.

Goal is to execute the “same base search” part only once in the workbook.

Defining a new function for “same base search” still means 3 executions, I guess.

Your response is appreciated.

Thank you.

​Coming from Splunk world and didn’t found answer to this in the workbook documentation. Is it possible to chains searches, like in Splunk, explained here:https://docs.splunk.com/Documentation/Splunk/9.3.1/DashStudio/dsChain Trying to explain in KQL terms: suppose there are 3 very similar queries, likesame base search | condition 1same base search | condition 2same base search | condition 3feeding 3 vizualizations.Goal is to execute the “same base search” part only once in the workbook.Defining a new function for “same base search” still means 3 executions, I guess. Your response is appreciated.Thank you.  Read More

​