Set search parameters in a variable

Comments

2 comments

  • Avatar
    Latimer Luis

    I see your point with respect to the ability to define your own variables, but you can accomplish something similar by updating your source category naming convention in way that will logically group your data. Doing so will allow you to write more efficient searches (e.g. _sourceCategory=prod*)

    Here's a blog post that may interest you: https://www.sumologic.com/2015/08/27/good-sourcecategory-bad-sourcecategory/

    0
    Comment actions Permalink
  • Avatar
    Scott Johnson

    I'm looking for the same thing as Chris but my need is a little more granular. I would like to assign a subset of hosts from a list of production servers and assign them to a variable. Lets say 10 hosts belong to client XYZ, I currently have to hard code the list in a where clause for each query in a dasboard I've built just to monitor client XYZ.  instead I'd like to maintain one list so that all queries will reference it.  Could this be done with a lookup table?  If so then can I define a list in a query and use the save option. 

    | xyz_hostname in ( list of hosts)

    |  save /clients/hostname/xyz

    ........

    | lookup hostname from /clients/hostname/xyz on hostname = xyz_hostname

    | count by a, b, xyz_hostname

    0
    Comment actions Permalink

Please sign in to leave a comment.