How to make a Splunk Dashboard dynamic?

Question

I have a query lets call it query1 that looks at sales and I have storenumber=1 in that query I have query2 that looks at returns with storenumber=1 in the second query

I want to add these queries to my store's dashboard. Now in the dashboard, I want to have a box (text, dropdown, anything) where I can enter a new store number and run both those queries.

If I enter say 2 in that box how does that 2 get replaced in the queries where store number =1 to be storenumber=2 now?

I thought it would be some token like variable? but I'm not sure how to get that to work so that the number entered is populated where the storenumber= is in the queries?

Any help will be appreciated Thank You

Answer 1

It is a token-like variable. When you create your input (dropdown, text, etc.) is it given a name. The value of that input is referenced simply by putting the token name within $s.

... | where storenumber = $store$ | ...