Knowledge Management

How to specify a value in one place and use it in several searches?

Splunk Employee
Splunk Employee

I have several saved searches that contain where vehicle_distance<=100. I want to make the value of 100 tunable in one place rather than having to edit all the searches.

I've discovered that I can set-up a macro, say, nbmaxdist that contains the above definition, then use it in a search like | nbmaxdist | (enclosed in backticks that I can't easily show here because a backtick is a Markdown special character).

This works, but is this the prescribed way to do this?

Tags (2)
0 Karma
1 Solution

Esteemed Legend

Macro is the best way.

View solution in original post

Esteemed Legend

Macro is the best way.


You can also set a global variable in a dashboard like this

    <set token="mso_index">main</set>
    <set token="mso_host">beta*</set>
0 Karma


That would be a good way to set a "global variable"

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...