Splunk Search
Highlighted

How to parameterize a search?

New Member

Is there a way to parameterize a search, for instance, lollipop="{first, second, third}".
I want to retrieve a table of data based on multiple search instances where the parameter changes based on a comma-delimited value.

0 Karma
Highlighted

Re: How to parameterize a search?

Communicator
0 Karma
Highlighted

Re: How to parameterize a search?

Esteemed Legend

You can use a macro or you can also use the savedsearch command, which is probably what you are seeking (search for replace_me😞
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Savedsearch

0 Karma