All Apps and Add-ons

How to implement user defaults for a multiselect drop-down input on a shared dashboard?


I have a dashboard that is shared by 10-15 users. On the dashboard, I have a multiselect drop-down which shows a list of up to 100 items (populated by a search, default selection is "Any" or "*"). The users are interested in different subsets of the list of items. They would like to have the selection default to their own user-defined subset of the main list. So, say

Jon wants his selections to default to items 1,3,6,23, 57
Mel wants her selections to default to items 17, 23, 43,64,88
Jimi wants his selections to default to 2, 75

Mel still wants to see all times 1-100 in her list, but wants the multselect to be set to 17, 23, 43,64,88 when the dashboard loads.

Is this possible to achieve in Splunk? How? My first thought was lookup tables or KV Store, but I don't think either of those can return a list of 1...n items. I would appreciate any help designing this capability that anyone can provide.


The current dashboard is Simple XML, but I can convert to using Sideview Utils if necessary.

0 Karma


You could do this with javascript if you are willing to put in the extra effort. It's not even that hard actually: you simply place a .js file in apps/your_app_name/appserver/static and give it this content:

], function (mvc, utils) {

    // Get info on user
    var userName = Splunk.util.getConfigValue("USERNAME");

    // Get the specific input
    var multi = mvc.Components.getInstance("multiselect");

    // Change the input values depending on username
    switch (userName) {
        case "Jon": {
        case "Mel": {
        case "Jimi": {
        default: {
            // ... behavior for all other users (can be empty)

You then go to the XML of your dashboard and edit the first line from



<form script="your_js_file.js">

In this XML, you'll also give your multiselect an id in order for the js code above to be able to set its values. Locate the input in question, and change it from something like

<input type="multiselect" token="...">


<input id="multiselect" type="multiselect" token="...">

Don't forget to restart your splunk once after adding the .js file, otherwise it won't get picked up by splunk. If I confused you, feel free to ask!

Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...