How to re-use list of values.

[iet_ashish]

I have a query which essentially looks like this,

| makeresults count=1 
| eval host="host1, host2, host3, host4, host5, host6" 
| makemv tokenizer="([^,]+),?" host 
| mvexpand host 
| fields - _time 
| join type=left host 
    [ search index=someIndex host IN (host1, host2, host3, host4, host5, host6) 
    | stats count as numEvents, first(field1) as field1Val, first(field2) as field2Value by host ]

As one can see I have to pass the list of hosts "host1, host2, host3, host4, host5, host6", once during "makeresults" and another time in the sub search. Is there any way to declare a variable for this list.

Is there a way to avoid this duplication. Sometimes this list of hosts can be really long. I want to send this query to a non-IT user who doesn't understand Splunk too well and was wondering if I can reduce the hassle for him.

Thanks,
Ashish

[manjunathmeti · Accepted solution]

You can update search query to use token parameter and save this search as Report (saved search).

| makeresults count=1 
 | eval host="$hosts$" 
 | makemv tokenizer="([^,]+),?" host 
 | mvexpand host 
 | fields - _time 
 | join type=left host 
     [ search index=someIndex host IN ($hosts$) 
     | stats count as numEvents, first(field1) as field1Val, first(field2) as field2Value by host ]

Once you save make sure to check permissions. Ask users to run saved search using savedsearch command with parameter like below:

| savedsearch saved_search_name hosts="host1, host2, host3, host4, host5, host6" 

[iet_ashish]

This is exactly what I was looking for. Thanks.

[martin_mueller]

The concept you're looking for is called macros. In the UI, go to Settings -> Advanced Search -> Search Macros to create one, remember to set sharing to App, and refer to the macro in your search using backticks. See https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Usesearchmacros

[martin_mueller]

If you store the hosts inside the macro you only need to list them out once, over all searches that require this particular list.

[iet_ashish]

Unfortunately this does not work for us. Let say I define a parameterized macro - "hostlist".
Even in this case the user would have to pass the macro to query twice,

makeresults 1
| hosts=hostlist(host1, host2, host3,....)
|join type=left
| [search host IN (hostlist(host1, host2, host3,....)`)]