You can also use variable expansion outside of subsearches. The syntax is:
field_name:$keyword
For example:
dsthost:$exec_pc
In this example, you would be executing the following search:
dsthost:"execcto" OR dsthost:"execcfo"
Which is the same as:
dsthost:["execcto","execcfo"]