Knowledge Management

How to specify a value in one place and use it in several searches?

Splunk Employee
Splunk Employee

I have several saved searches that contain where vehicle_distance<=100. I want to make the value of 100 tunable in one place rather than having to edit all the searches.

I've discovered that I can set-up a macro, say, nbmaxdist that contains the above definition, then use it in a search like | nbmaxdist | (enclosed in backticks that I can't easily show here because a backtick is a Markdown special character).

This works, but is this the prescribed way to do this?

Tags (2)
0 Karma
1 Solution

Esteemed Legend

Macro is the best way.

View solution in original post

Esteemed Legend

Macro is the best way.

View solution in original post

Motivator

You can also set a global variable in a dashboard like this

<init>
    <set token="mso_index">main</set>
    <set token="mso_host">beta*</set>
  </init>
0 Karma

Legend

That would be a good way to set a "global variable"

0 Karma