User Variables

Overview

User-defined variables are parameters that connect input controls and query widgets on dashboards. Values entered in input controls are stored in variables, and query widgets reference those values to dynamically change the displayed data.

For example, to view only events from a specific IP address on a security monitoring dashboard, create a string-type user-defined variable named src_ip and connect it to a text input control. When a dashboard user enters an IP address in the input control, the value is stored in the variable, and query widgets use that value as a filter condition to display only matching events.

Variable values are injected into queries through dashboard dynamic filters. When a filter is activated, the variable value is prepended to the query as a set <variable_name> = <value> command, changing the query widget output. You can view or reset currently set variables and values in the dashboard filter panel.

The type of variable that can be connected depends on the input control type.

Input control	Connectable variable types
Date input control	Date
Text input control	String
List input control	All types

Users with dashboard-related permissions can access this page. To add, edit, or delete variables, you need the Dashboard Admin, Dashboard Edit, or Widget Edit permission.

View and search variables

You can view the user-defined variable list under Dashboard > User-Defined Variables.

Name: Name of the user-defined variable. Click to open the edit panel.
Type: Data type of the variable
Description: Description of the variable
Owner: Account that created the variable
Created At: Date the variable was created (yyyy-MM-dd format)
Modified At: Date the variable was last modified (yyyy-MM-dd format)

To find a specific variable, enter a keyword in the field in the toolbar. The search finds variables whose Name contains the keyword. The search is case-sensitive.

Download list

To download the variable list as a file, click in the toolbar.

Refresh list

To refresh the list with the latest data, click in the toolbar.

Add variable

To add a user-defined variable:

Click Add in the toolbar of the variable list.
Enter the variable properties in the side panel, then click OK.
- Name: Unique name of the variable (required, up to 50 characters). Only Korean, English, numbers, and underscores (_) are allowed. The name cannot start with an underscore.
- Type: Data type of the variable (default: String). Available types are:
  - String: Text data
  - Boolean: True/false value
  - Short (16 bits): 16-bit integer
  - Integer (32 bits): 32-bit integer
  - Long (64 bits): 64-bit integer
  - Float (32 bits): 32-bit floating-point number
  - Double (64 bits): 64-bit floating-point number
  - Date: Date and time
  - Country: Country code
  - Port: Port number
  - IP address: IP address
- Description: Detailed description of the variable (up to 2,000 characters)

Note

Three reserved variables exist that are not displayed in the variable list: _from, _to, and _span. _from and _to are date-type variables used to specify the start and end of a search period. _span is a string-type variable used to specify a time unit.

Note

When setting up a dynamic filter or time truncation formula, the variable list in the dialog only displays variables of the same type as the target field.

Edit variable

To edit a user-defined variable:

Click the Name of the variable you want to edit in the variable list.
Modify the information in the side panel, then click OK. The Name cannot be changed.

Delete variable

To delete a user-defined variable:

Select the checkbox of the variable row you want to delete in the variable list.
Click Delete in the toolbar.
In the Remove User-Defined Variable dialog, confirm the list of variables to delete, then click Delete. Click Cancel to cancel the operation.

Note

If a widget references the variable you are trying to delete, you must first remove the variable reference from that widget.