When building a dashboard with multiple widgets and different queries, the parameters defined in each query will be extracted and then used to build all of the parameters for the dashboard.

To use the same parameter across multiple queries, use the same parameter definition in each query. For example, the following queries for different widgets on a single dashboard would create two unique parameters in the dashboard that the user could implement, and the same value for each parameter would be applied to both queries. This enables you to use common parameters across all the queries in a dashboard:

For queries executing automatically like Triggers or Scheduled searches, a default parameter value can be defined to ensure that the parameter has a value and the query doesn't fail.

To specify a default value, use the following syntax in your query:

?{PARAMETER=VALUE}

Where:

For example, this creates the parameter param with the default value default_value.

?{param=default_value}

Saved searches can make use of user-defined parameters, enabling values to be supplied to saved searches at execution time. For example, to create a saved search that executes a groupBy(), create a saved search called grouped():

groupBy(field=?{basefield="@host"})

This exposes the parameter basefield in the grouped() saved search, which can then be called using:

$grouped(basefield="@host")

When using Multi-value Parameters in dashboards, multiple values can be added at the same time by using commas as a delimiter for user-inputs in the UI. To add multi-value parameters to your query for a dashboard, use the syntax as in the following examples: