Saved Searches and Passing Parameters

Path Finder

I have a saved search which I would like to pass a "host=XXX" parameter to. Can this be done? If so, do I have to modify the saved search? Can you point me to some examples?

Thanks in advance for your assistance.

Tags (1)


Just to be more clear.

Search should be saved as
index=xyz KEY_1=123 KEY_2=456 host=$host$

When using in a dashboard it should be
| savedsearch saved_search_name host=$host$

0 Karma


How can we set these parameters in a dashboard panel ?
MySavedSearch host=XYZ gives

Configuration error - we were not able to find a saved search called "MySavedSearch host=XYZ".

0 Karma


use the below

| savedsearch "MySavedSearch" host="XYZ

0 Karma

Splunk Employee
Splunk Employee

yes you can

(1) create a savedsearch whose search looks like this (use $variable$):

search = .... host=$host$ ...

(2) invoke this from the search as follows

| savedsearch MySavedSearch host=XYZ


This does not work if your savedsearch evals something to the passed parameter, and then you want that to be included in the email. In this case you must include strings in the savedsearch eval statement eval test="$passed_param$" NOT eval test=$passed_param$. If you aren't evaling then this solution works as described without the quotes.

0 Karma

Path Finder

Is anyone aware of a way to iterate over several variables as a part of a scheduled search?

I would like to do something like this:

search = sourcetype=mysourcetype locale=$locale$
| outputlookup mylookup$locale$.csv

This works to run manually from the search bar - any guidance on how to do this automatically? Dealing with an indeterminate number of locales.

0 Karma

Path Finder

Ultimately used 2 saved searches, 1 with $locale$ and then a second search with | makeresults and | map:
| makeresults | eval locales = "ja,de,en"
| eval locale = split(locales,",")
| mvexpand locale
| map saved_search_name
The first one is unscheduled, the second is scheduled.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...