Saved Searches and Passing Parameters

[tmurray3]

I have a saved search which I would like to pass a "host=XXX" parameter to. Can this be done? If so, do I have to modify the saved search? Can you point me to some examples?

Thanks in advance for your assistance.

[dshroff]

Just to be more clear.

Search should be saved as
saved_search_name
index=xyz KEY_1=123 KEY_2=456 host=$host$

When using in a dashboard it should be
| savedsearch saved_search_name host=$host$

[christophe_sahu]

How can we set these parameters in a dashboard panel ?
MySavedSearch host=XYZ gives

Configuration error - we were not able to find a saved search called "MySavedSearch host=XYZ".

[abhayneilam]

use the below

| savedsearch "MySavedSearch" host="XYZ

[Ledion_Bitincka]

yes you can

(1) create a savedsearch whose search looks like this (use $variable$):

search = .... host=$host$ ...

(2) invoke this from the search as follows

| savedsearch MySavedSearch host=XYZ

[nick405060]

This does not work if your savedsearch evals something to the passed parameter, and then you want that to be included in the email. In this case you must include strings in the savedsearch eval statement eval test="$passed_param$" NOT eval test=$passed_param$. If you aren't evaling then this solution works as described without the quotes.

[camillak]

Is anyone aware of a way to iterate over several variables as a part of a scheduled search?

I would like to do something like this:

search = sourcetype=mysourcetype locale=$locale$
| outputlookup mylookup$locale$.csv

This works to run manually from the search bar - any guidance on how to do this automatically? Dealing with an indeterminate number of locales.

[camillak]

Ultimately used 2 saved searches, 1 with $locale$ and then a second search with | makeresults and | map:
| makeresults | eval locales = "ja,de,en"
| eval locale = split(locales,",")
| mvexpand locale
| map saved_search_name
The first one is unscheduled, the second is scheduled.