- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have arguments for my macro that contain other values e.g. $env:user$ and $timepicker.earliest$/$timepicker.latest$. How do I include these in my macro definition as it doesn't allow me since macro arguments must only contain alphanumeric, '_' and '-' characters?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Use macro params to pass these tokens. Here is an example:
Name | Definition | Arguments |
non-alphabetic-token(2) | index=_internal earliest=$earliest_tok$ latest=$latest_tok$ | earliest_tok, latest_tok |
<form version="1.1" theme="light">
<label>Non-alphabetic tokens</label>
<description>https://community.splunk.com/t5/Splunk-Search/How-to-include-arguments-in-search-macros-with-non-alphanumeric/m-p/696333#M236667</description>
<fieldset submitButton="false">
<input type="time" token="timepicker" searchWhenChanged="true">
<label>pick time</label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>$timepicker.earliest$</title>
<table>
<search>
<query>`non-alphabetic-token($timepicker.earliest$, $timepicker.latest$)`
| addinfo
| stats count by info_min_time info_max_time
| foreach info_*
[eval <<FIELD>> = strftime(<<FIELD>>, "%F %T")]</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
Here are some sample interactions:
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I'm not sure you understand the macros correctly.
if you define a macro with two parameters paramA and paramB it will get substituted in your search with whatever values you specify for them. These are separate layers.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Use macro params to pass these tokens. Here is an example:
Name | Definition | Arguments |
non-alphabetic-token(2) | index=_internal earliest=$earliest_tok$ latest=$latest_tok$ | earliest_tok, latest_tok |
<form version="1.1" theme="light">
<label>Non-alphabetic tokens</label>
<description>https://community.splunk.com/t5/Splunk-Search/How-to-include-arguments-in-search-macros-with-non-alphanumeric/m-p/696333#M236667</description>
<fieldset submitButton="false">
<input type="time" token="timepicker" searchWhenChanged="true">
<label>pick time</label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>$timepicker.earliest$</title>
<table>
<search>
<query>`non-alphabetic-token($timepicker.earliest$, $timepicker.latest$)`
| addinfo
| stats count by info_min_time info_max_time
| foreach info_*
[eval <<FIELD>> = strftime(<<FIELD>>, "%F %T")]</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
Here are some sample interactions:
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Amazing! Thank you. Yes I misunderstood macros.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Or is there another way to use re-usable SPL searches that can take these values into account?
