How to specify a value in one place and use it in several searches?

[plucas_splunk]

I have several saved searches that contain where vehicle_distance<=100. I want to make the value of 100 tunable in one place rather than having to edit all the searches.

I've discovered that I can set-up a macro, say, nbmaxdist that contains the above definition, then use it in a search like | nbmaxdist | (enclosed in backticks that I can't easily show here because a backtick is a Markdown special character).

This works, but is this the prescribed way to do this?

[woodcock · Accepted solution]

Macro is the best way.

[dbcase]

You can also set a global variable in a dashboard like this

<init>
    <set token="mso_index">main</set>
    <set token="mso_host">beta*</set>
  </init>

[sundareshr]

That would be a good way to set a "global variable"