User Parameters (Variables)

User-configurable parameters can be added to a query to allow for the user to specify a value in place of a fixed value within the query. The user-configurable value can also be integrated with dashboards and saved searches.

To create a user-supplied parameter, use the ? character in front of the parameter name. For example: ?parameter. The expression can be embedded in the query and will be interpreted by dashboards and saved searches automatically, providing a prompt for user-input:

logscale
matchstring := ?searchtext

In the above example, the named parameter will be searchtext.

For information on using parameters when using Dashboards, see Configuring Dashboard Parameters.

For information on using parameters with saved searches, see User Functions (Saved Searches).

Default Parameter Values

For queries that execute in a automated context, for example Alerts or Scheduled Searches, a default value to a parameter can be defined to ensure that the parameter has a value and the query does not fail.

To specify a default value, use the following syntax in your query:

logscale
?{param=default_value}

Multi-Value Parameters Syntax for Dashboards

Multiple values can be added at the same time to Multi-value Parameters using commas as a delimiter for user-inputs in the UI. Some syntax examples follow.

User Input Parameter Value Options
cat, hat cat and hat
"cat, hat" cat, hat
\"cat, hat\" "cat and hat"
\"cat\", \"hat\" "cat" and "hat"