Dashboards & Visualizations

Can I have arrays or indexed variables in an app's (or dashboard's) conf file?

neiljpeterson
Communicator

This is probably a dumb question.... but I have researched it from various angles and cannot find what I am looking for exactly.

How can I store an arbitrary number of variables that will be persistent and can be accessed by all the dashboards in an app?

In my case, this will be a list of servers that the app needs to search and I would like to be able to set these values once and know that any existing or new dashboards will be able to search data from those hosts.

I am imagining something like: $servers = [host1, host2, host3] etc... and my searches can written like "host=$servers[0] OR host=$server[1] OR host=$server[2]..." up to whatever maximum number of servers I want to allow on my dashboards. Is such a thing possible?

( It would be even better if there was (or could be written) a macro that would make the number of elements searched for truly arbitrary such that I can define the variable and the boolean joiner... a la foobar($servers, "OR") and away we go... but one thing at a time )

I assume this will go in a myconf.conf or something similar? I could not find any reference of the datatypes or structures possible for the conf files, but perhaps I missed it.

Please point me in the right direction! Thanks!

0 Karma

Ayn
Legend

I guess you could do this using lookups? Define a lookup in your app that holds the servers you're interested in, then use this lookup in your searches like this:

<yourbasesearch> [|inputlookup mylookup | fields host]

After the subsearch has run, this will expand to something like this:

<yourbasesearch> ((host="server1") OR (host="server2") OR (host="server3"))
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...