How do I reuse multiple eval statements in multiple dashboards without recoding in every one?

[pxs0514]

I have a series of eval statements that I'd like to call from multiple dashboards, but have it coded in only one place for ease of maintenance. Below are the statements I need that do calculations differently based on the date. What's the best way to accomplish this?

| eval timecheck=substr(DATETIME,1,10) |  eval current_epoch = strptime(timecheck,"%Y-%m-%d")     
                |  eval Upgrade_Date=strptime("2017-01-22","%Y-%m-%d")                                                      <!-- Date of CPU Upgrade  -->
                |  eval current_mips = if(current_epoch>=Upgrade_Date,3322,3400)                                           <!-- NewMIPS,OldMIPS -->
                |  eval current_cps = if(current_epoch>=Upgrade_Date,5400,4500)                                             <!-- NewCPs,OldCPs -->
                |  eval MipsGP = cpusecs / current_cps *current_mips                                                <!-- GP secs / gpMips * secs avail -->
                | eval MipsGP=round(MipsGP,1)       

[kamlesh_vaghela]

HI @pxs0514,

You can define all evals in a macro and use it in search of multiple dashboards. By using macro you can manage eval calculations from one place.

Check below Link:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Knowledge/Searchmacroexamples

Let me know if any assistance.

Thanks
Kamlesh

[nabeel652]

Use calculated fields.

http://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/definecalcfields

[woodcock]

You have several options:

1: Make the field extractions automatic for every search on this sourcetype (using props.conf and tranforms.conf)
2: Put them into a macro and call the macro.
3: Put them into a base search inside the dashboard and use post-process searches in the panels (may not work depending on your searches).