Spread our blog

How To Pass Multiple Values From Multi-select Input Option Using Single Argument Macro In Splunk ( Usage Of |s Filter With Tokens )

Hello Everyone !!!

Hope all of you are enjoying these blog posts. Today we have come with a new and very interesting topic of Splunk. All of you know that how to pass arguments inside macro. Today we will reveal one secret of Splunk which you had  never seen before. But today we will show you how to pass multiple values inside a macro from multi-select input option in Splunk dashboard. Also we will let you know the usage of “|s” with token in Splunk.

Step 1:

Create a single argument macro with which you want to work with. You can find more information about Macro by clicking the below link.

How To Create A Search Macro In Splunk


Step 2:

Create a dashboard using the macro. For initial creating the dashboard use “*” inside the macro. Save as Dashboard Panel.


Step 3:

Give a dashboard name. We have given dashboard name as MacroTricks and given a panel title as Test. Click on Save to save the dashboard.


Step 4:

Open the dashboard. You can find the Edit option on the top right corner of the dashboard.

Click on Edit to edit the dashboard.


Step 5:

You can find the Add Input option on the top. Click on Add Input and then click on Multiselect to add a multi-select option in dashboard. You can find the more information about Multiselect from the below link.

How To Add Multiselect Input Option To Splunk Dashboard

You can also know about :  How To find The Current Size And Total Event Count Of Any Index In Splunk





Step 6:

Click on Edit Search option of the panel to make dependent the panel upon the token which we created in Multiselect option.


Step 7:

We have to pass the token name. You have to write the token name inside the “$” sign. Also we have written the token name along the “|s”. We have used the token name as “chgs_token” which is already we defined in multi-select option. Click on Apply to save the changes. Then click on Save to save the changes.



Step 8:

We have selected the two input from multi-select option. Click on Open In Search to see the Usages of “|s” filter.



Step 9 :  

So the “|s” filter put double quotation mark around the value returned by the token. See the green marked option. And also escape all quotation character within the quoted value. See the blue marked option. This “|s” filter is very much useful when you have a field value containing space in middle. Also it is very much useful for the drilldown purpose.



Hope this has helped you in achieving the below requirement without fail !!

How To Pass Multiple Values From Multi-select Input Option Using Single Argument Macro In Splunk ( Usage Of |s Filter With Tokens )

Happy Splunking !!

What’s your Reaction?

Spread our blog


Please enter your comment!
Please enter your name here