Knowledge Management

How to specify a value in one place and use it in several searches?

plucas_splunk
Splunk Employee
Splunk Employee

I have several saved searches that contain where vehicle_distance<=100. I want to make the value of 100 tunable in one place rather than having to edit all the searches.

I've discovered that I can set-up a macro, say, nbmaxdist that contains the above definition, then use it in a search like | nbmaxdist | (enclosed in backticks that I can't easily show here because a backtick is a Markdown special character).

This works, but is this the prescribed way to do this?

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Macro is the best way.

View solution in original post

woodcock
Esteemed Legend

Macro is the best way.

dbcase
Motivator

You can also set a global variable in a dashboard like this

<init>
    <set token="mso_index">main</set>
    <set token="mso_host">beta*</set>
  </init>
0 Karma

sundareshr
Legend

That would be a good way to set a "global variable"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...