Dashboards & Visualizations

Dealing with empty selections in complex forms

lassel
Communicator

I have the following (simplified) dynamic dashboard.
You can see the query beeing performed in html.

I want the sourcetype selection is optional on this dashboard. But as it is the $sourcetype$ token is not resolved until I make a selection in the sourcetype. Setting a default sourcetype to empty doesn't work, because that will make an invalid search and also because the empty selection stays when I select an index.

  • How can I make the search run, even if no selection is made to sourcetype?
  • How can I clear the (invalid) sourcetype selections, when I select an index?

    index=* | dedup index 0 index index true | search index= false * <query>$index$ | dedup sourcetype</query> 0 sourcetype sourcetype ( sourcetype=" " OR )
    @d now
              $index$ $sourcetype$ $search$
            
    <query>$index$ $sourcetype$ $search$</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest>
0 Karma
1 Solution

helge
Builder

You could use a token forwarder like this:

Don't use the sourcetype token in your search directly. Instead, build a new token with the help of a token forwarder. In the Javascript function that actually sets the new forwarded token's value you can easily provide a default value.

For possible alternatives also look at token change event handlers and token filters, documented on the same page as forwarders.

View solution in original post

0 Karma

helge
Builder

You could use a token forwarder like this:

Don't use the sourcetype token in your search directly. Instead, build a new token with the help of a token forwarder. In the Javascript function that actually sets the new forwarded token's value you can easily provide a default value.

For possible alternatives also look at token change event handlers and token filters, documented on the same page as forwarders.

0 Karma

lassel
Communicator

Did you notice that I use simple XML?

But I need to convert my dashboard to html to do it?
It seems like a complex task for a simple goal..

0 Karma

helge
Builder

You don't have to convert your dashboard to HTML, you only need to include a script like this:

<form script="myscript.js"

In that script you can then use the technique I described.

0 Karma

lassel
Communicator

Oh! Great. I had no idea you could do that!

0 Karma

lassel
Communicator

I would also really really like to know, how I can make the user experience of my dashboard, more like the full search page.

0 Karma

lassel
Communicator

i'd still like an answer to this question ...

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...