Splunk Search

Does splunk support parameterized queries

Path Finder

I am curious if parametrized queries are possible within within splunk dashboards or searches:

ex. query: foo=bar AND env=${VARIABLE}

I would then like to be able to define VARIABLE at a higher level or perhaps even have a preamble in the query such as: SET VARIABLE=prod : foo=bar AND env=${VARIABLE}.

This appears to be a similar question: link text


Tags (1)


Use the form dashboard or the pulldown dashboard, here would be an example:

<form class="formsearch">
       <label>Test Form</label>
              <input type="dropdown" token="breakdown" searchWhenChanged="true">
                       <choice value="QHour">Quarter Hour</choice>
                       <choice value="Hour">Hour</choice>

                     <searchString>index=main $breakdown$ </searchString>

So the FieldSet block builds a drop down menu and sets the variable "breakdown" to what ever the user selects, then passes that variable to a chart.

Hope this helps!

Path Finder

Thanks, that looks like a good place to start.

0 Karma