Splunk Search

Create and Reuse Variable in Multiple Places

Explorer

Hi guys.

I want to create a variable, lets say my_var_thresdold = 1000
After that, I want to use that var in two places:

  1. Within an alert: place my_var_thresdold as a trigger condition; like: is_greater than $my_var_thresdold$ External var in an alert
  2. Within a dashboard, when writing a query, use that very same var; like | eval maxAlert=$my_var_thresdold$ External var within a dashboard

I was taking a look at SideView utils, but I was not able to find anything that works for my situation. Thanks.

0 Karma
1 Solution

Explorer

Hi. I ended up using a lookup table, storing my thresholds there and using them from both the dashboard query and from the alert query.

View solution in original post

0 Karma

Explorer

Hi. I ended up using a lookup table, storing my thresholds there and using them from both the dashboard query and from the alert query.

View solution in original post

0 Karma

Builder

Under

<form>
  <init>
     <set token="my_var_threshold">1000</set>
  </init>
.... Your other xml code

</form>

Define the token and then use it anywhere in your searches just like a variable.

0 Karma

Explorer

Thanks @nabeel652
This not suffice the need because when creating a var inside a dashboard it will only live within that context and it won't be visible when configuring my alert.

0 Karma