Dashboards & Visualizations

Can I have arrays or indexed variables in an app's (or dashboard's) conf file?

neiljpeterson
Communicator

This is probably a dumb question.... but I have researched it from various angles and cannot find what I am looking for exactly.

How can I store an arbitrary number of variables that will be persistent and can be accessed by all the dashboards in an app?

In my case, this will be a list of servers that the app needs to search and I would like to be able to set these values once and know that any existing or new dashboards will be able to search data from those hosts.

I am imagining something like: $servers = [host1, host2, host3] etc... and my searches can written like "host=$servers[0] OR host=$server[1] OR host=$server[2]..." up to whatever maximum number of servers I want to allow on my dashboards. Is such a thing possible?

( It would be even better if there was (or could be written) a macro that would make the number of elements searched for truly arbitrary such that I can define the variable and the boolean joiner... a la foobar($servers, "OR") and away we go... but one thing at a time )

I assume this will go in a myconf.conf or something similar? I could not find any reference of the datatypes or structures possible for the conf files, but perhaps I missed it.

Please point me in the right direction! Thanks!

0 Karma

Ayn
Legend

I guess you could do this using lookups? Define a lookup in your app that holds the servers you're interested in, then use this lookup in your searches like this:

<yourbasesearch> [|inputlookup mylookup | fields host]

After the subsearch has run, this will expand to something like this:

<yourbasesearch> ((host="server1") OR (host="server2") OR (host="server3"))
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...