Dashboards & Visualizations

Cascading Splunk dropdown will not populate on the first selection but will on the second?

smashedpumpkins
Explorer

Hey folks, I hope you can help me out as I'm stumped. I have a cascading dropdown menu. The 2nd dropdown menu relies on the first to obtain its variables. When I load the page, the first dropdown menu populates with no issue. When I make a selection with the first dropdown menu the second dropdown menu does not populate. If I select a different item in the first dropdown menu, after having already made my first selection, the second dropdown menu populates just fine. It does not matter which item I select in the first drop down menu, the issue always occurs.

<input type="dropdown" token="UCID">
  <label>Select Item</label>
  <default>Default Item 1</default>
  <populatingSearch fieldForValue="UCID" fieldForLabel="UCID">
    <![CDATA[|inputlookup item_1_lookup | fields "Use Case" | rename "Use Case" AS "UCID" | uniq "UCID" | sort "UCID"]]>
  </populatingSearch>
</input>
<input type="dropdown" token="FNAME">
  <label>Select Sub-item</label>
  <default>*</default>
  <populatingSearch fieldForValue="FNAME" fieldForLabel="FNAME">
    <![CDATA[|inputlookup item_1_lookup | search "Use Case"="$UCID$" | fields "Field Name" | rename "Field Name" AS "FNAME" | sort "FNAME"]]>
  </populatingSearch>
</input>
Tags (2)
0 Karma
1 Solution

smashedpumpkins
Explorer

I finally managed to fix it. The default value for the first dropdown menu was no longer located in the lookup table. Once I removed the default value it worked normally again. Sounds like a Splunk bug.

View solution in original post

0 Karma

smashedpumpkins
Explorer

I finally managed to fix it. The default value for the first dropdown menu was no longer located in the lookup table. Once I removed the default value it worked normally again. Sounds like a Splunk bug.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...