Just to make sure I’m understand you correct.
User makes a dashboard
User searches the following DB Access actions: ACTION_NAME:LOGON OR ACTION_NAME:LOGOFF
User want to save that search, user clicks the save button.
Third point should be corrected as:
User want to save the dashboard with the last search, user clicks the save button.
Second way would be.
User goes to Search tab then the User searches the following DB Access actions: ACTION_NAME:LOGON OR ACTION_NAME:LOGOFF
User Click the Save button there for the user created a saved search.
From that saved search the user can migrate that save search to any dashboard that user wants to.
In the third point I do not see any point of saving it (the saved search) as a dashboard. This because in the Graylog Search (menu tab) dashboard the Load/Save includes not only the search time, string and stream, but also all widgets. Thus one can work faster with loading saved searches in the Graylog Search (multiple tabs can be opened also) compared to with multiple user-made dashboards.
I must underline intend to keep the same search for all widgets of a dashboard - which as per docs is the main dashboards feature.
At this point I intend to ask a new question, kind of: “content packs - better use saved-searches or dedicated dashboards”
Correct me if I’m wrong but I think I’m understanding?
EDIT: after reading over this, Ill be honest it would be nice to Load a save search from the dashboard.
Perhaps posting a feature request
I think yes - dashboards must enable load/save of saved searches, at top level, and not only in widgets