Dashboards & Visualizations

Splunk and variables/constants

ateterine
Path Finder

Rather simple question but not sure if there is a solution for this.

I am running a search

search event_number=123

This search is powering multiple reports. Each report, right now, has that value embedded. Twice a month event_number changes and increases by 1. So when we prepare for the next event, we have to go through all reports and change search strings to

search event_number=124

Was wondering if there is a simple way to set up the variable/constant X=123 and run search
search event_number=X
So when we do change to event_number 125, we would have to do it only once.

Thanks!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Ayn
Legend

Or eventtypes. Take your pick. 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...