Start with one or more input parameters so you don’t have to copy and edit an old query just to change an ip address, mac address, user idSearch parameters live inside Graylog queries and saved searches. Think of search parameters as placeholders for the values you’re investigating and wanting to track, for tasks you need to do more than once, and/or saved searches you want to share with other members of the team or with other departments., etc.; and even chain queries together so the results of one search become the input parameter to the next.
Search parameters eliminate the need to build big queries to investigate or monitor items that vary (e.g., ip address, mac address, user id, etc.). By saving parameterized searches for those regular issues that come up, ensures that team members are running the same search every time it runs and as a result, they can support, monitor, investigate, systems with confidence and speed.
Search Parameters paired with Search Workflow make it possible to build and combine multiple searches for any type of analysis into one action and review your delivered results on a dashboard-like screen(or multiple tabs for really complex tasks). Best of all, you can easily save and share these parameterized Search Workflows to ensure consistency, save time and empower more junior team members.