Reporting

Saved Searches and Passing Parameters

tmurray3
Path Finder

I have a saved search which I would like to pass a "host=XXX" parameter to. Can this be done? If so, do I have to modify the saved search? Can you point me to some examples?

Thanks in advance for your assistance.

Tags (1)

dshroff
Engager

Just to be more clear.

Search should be saved as
saved_search_name
index=xyz KEY_1=123 KEY_2=456 host=$host$

When using in a dashboard it should be
| savedsearch saved_search_name host=$host$

0 Karma

christophe_sahu
Explorer

How can we set these parameters in a dashboard panel ?
MySavedSearch host=XYZ gives

Configuration error - we were not able to find a saved search called "MySavedSearch host=XYZ".

0 Karma

abhayneilam
Contributor

use the below

| savedsearch "MySavedSearch" host="XYZ

0 Karma

Ledion_Bitincka
Splunk Employee
Splunk Employee

yes you can

(1) create a savedsearch whose search looks like this (use $variable$):

search = .... host=$host$ ...

(2) invoke this from the search as follows

| savedsearch MySavedSearch host=XYZ

nick405060
Motivator

This does not work if your savedsearch evals something to the passed parameter, and then you want that to be included in the email. In this case you must include strings in the savedsearch eval statement eval test="$passed_param$" NOT eval test=$passed_param$. If you aren't evaling then this solution works as described without the quotes.

0 Karma

camillak
Path Finder

Is anyone aware of a way to iterate over several variables as a part of a scheduled search?

I would like to do something like this:

search = sourcetype=mysourcetype locale=$locale$
| outputlookup mylookup$locale$.csv

This works to run manually from the search bar - any guidance on how to do this automatically? Dealing with an indeterminate number of locales.

0 Karma

camillak
Path Finder

Ultimately used 2 saved searches, 1 with $locale$ and then a second search with | makeresults and | map:
| makeresults | eval locales = "ja,de,en"
| eval locale = split(locales,",")
| mvexpand locale
| map saved_search_name
The first one is unscheduled, the second is scheduled.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...