Splunk Search

Using variable in same search

JYTTEJ
Communicator

Hi. I am going to set up the same search - for a lot of different hosts.(20)

The result of the search is displayed on 2 different dashboards.

The search is running every 30 minutes - thus updating the dashboard every 30 minutes.

I would like to use the same search - and just reference the different hosts - instead of having 20 saved searches which are the same - only difference is the host name.

How do I accomplish this?

Tags (1)
0 Karma

Ayn
Legend

This sounds like a good situation to use a search macro. I could describe it a bit more but really I think the docs explain the concept best though: http://docs.splunk.com/Documentation/Splunk/latest/User/CreateAndUseSearchMacros

Ayn
Legend

No problem! Could you please mark my answer as accepted? Thanks!

0 Karma

JYTTEJ
Communicator

Great! thank you so much!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...