Global Variable in splunk dashboard

[reney44]

how to set and get Global variable across splunk dashboard

there is no possible way to access variable in multiple search,
scope of variable include inside a search or macro

[nick405060 · Accepted solution]

To set, e.g:

<search>
  <query>
| makeresults | eval myvar="this is my variable" | table myvar
  </query>
  <preview>
    <set token="access_me">$result.myvar$</set>
  </preview>
</search>

To get:

... | eval this_is_somewhere_else_in_my_code="$access_me$"

However, remember that SimpleXML replaces the token with its value and THEN evaluates the SimpleXML. So if you were to not wrap your token in quotes like ... | eval this_is_somewhere_else_in_my_code=$access_me$, it would be evaluated as ... | eval this_is_somewhere_else_in_my_code=this is my variable instead of ... | eval this_is_somewhere_else_in_my_code="this is my variable" and therefore break your SimpleXML code.

Not wrapping your token in quotes is sometimes desirable, e.g. if you want to dynamically modify your SPL or SimpleXML code itself. However most of the time especially in a <query> stanza you are going to want to wrap your token in quotes.

[CarbonCriterium]

@nick405060

This works for me, but my global variable is the sum of a very lengthy search.  

For as long as the search that creates the global variable is running, the search that uses starts, cancels itself, and then starts again, over and over and over.  All searches eventually run as expected, but its not pretty to look at.  

Is there a way to hold the dependent search from starting until the global variable has been created?

[jpolvino]

One "sneaky" way to do this is to provide the value in the dashboard URL:

https://your.splunk.url/en-US/app/search/dashboardname?yourtoken=yourtokenval

Then in your dashboard, you can use $yourtoken$ in searches and titles. Just be sure to URL encode youtokenval so it will parse properly.

This works great is you bookmark the dashboard, or want to test it out. If you just let people navigate to the dashboards, they won't get this additional key/val.

[niketn]

@reney44 tokens once they are set in a dashboard are available across the dashboard. So for the community to assist you better please elaborate as to what you are trying to do? How is the token being set? Is it in <init> section, or through search event handler, or through visualization drilldown? Which all places do you want to use the token in the dashboard? If you have already set the token what is the issue while using it in macro? Does your macro have a parameter so that it can accept the token as input?