topic Re: Create and Reuse Variable in Multiple Places in Splunk Search

Create and Reuse Variable in Multiple Places

jslealdi — Wed, 30 Sep 2020 01:16:42 GMT

Hi guys.

I want to create a variable, lets say my_var_thresdold = 1000
After that, I want to use that var in two places:

Within an alert: place my_var_thresdold as a trigger condition; like: is_greater than $my_var_thresdold$
Within a dashboard, when writing a query, use that very same var; like | eval maxAlert=$my_var_thresdold$

I was taking a look at SideView utils, but I was not able to find anything that works for my situation. Thanks.

Re: Create and Reuse Variable in Multiple Places

nabeel652 — Wed, 10 Jul 2019 23:31:55 GMT

Under

<form>
  <init>
     <set token="my_var_threshold">1000</set>
  </init>
.... Your other xml code

</form>

Define the token and then use it anywhere in your searches just like a variable.

Re: Create and Reuse Variable in Multiple Places

jslealdi — Thu, 11 Jul 2019 15:53:23 GMT

Thanks @nabeel652
This not suffice the need because when creating a var inside a dashboard it will only live within that context and it won't be visible when configuring my alert.

Re: Create and Reuse Variable in Multiple Places

jslealdi — Mon, 22 Jul 2019 20:00:36 GMT

Hi. I ended up using a lookup table, storing my thresholds there and using them from both the dashboard query and from the alert query.