Splunk Search

Create and Reuse Variable in Multiple Places

jslealdi
Explorer

Hi guys.

I want to create a variable, lets say my_var_thresdold = 1000
After that, I want to use that var in two places:

  1. Within an alert: place my_var_thresdold as a trigger condition; like: is_greater than $my_var_thresdold$ External var in an alert
  2. Within a dashboard, when writing a query, use that very same var; like | eval maxAlert=$my_var_thresdold$ External var within a dashboard

I was taking a look at SideView utils, but I was not able to find anything that works for my situation. Thanks.

0 Karma
1 Solution

jslealdi
Explorer

Hi. I ended up using a lookup table, storing my thresholds there and using them from both the dashboard query and from the alert query.

View solution in original post

0 Karma

jslealdi
Explorer

Hi. I ended up using a lookup table, storing my thresholds there and using them from both the dashboard query and from the alert query.

0 Karma

nabeel652
Builder

Under

<form>
  <init>
     <set token="my_var_threshold">1000</set>
  </init>
.... Your other xml code

</form>

Define the token and then use it anywhere in your searches just like a variable.

0 Karma

jslealdi
Explorer

Thanks @nabeel652
This not suffice the need because when creating a var inside a dashboard it will only live within that context and it won't be visible when configuring my alert.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...