{
"visualizations": {},
"dataSources": {
"ds_ouyeecdW": {
"type": "ds.search",
"options": {
"enableSmartSources": true,
"query": "| makeresults\n| eval env = \"$env$\"\n| eval dependent=case(env=\"Q1\", \"DIRECT\", env=\"Q2\", \"DIRECT;20;21;22;23\", env=\"Q3\", \"DIRECT;30;31\", env=\"Q4\", \"DIRECT;40;41;42;43;44\")\n| makemv dependent delim=\";\"\n| mvexpand dependent\n| table dependent"
},
"name": "Search_Dependent_Dropdown"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"latest": "$global_time.latest$",
"earliest": "$global_time.earliest$"
}
}
}
}
},
"inputs": {
"input_ZIhOcc3q": {
"options": {
"items": [
{
"label": "Q1",
"value": "Q1"
},
{
"label": "Q2",
"value": "Q2"
},
{
"label": "Q3",
"value": "Q3"
},
{
"label": "Q4",
"value": "Q4"
}
],
"token": "env",
"selectFirstSearchResult": true
},
"title": "Environment",
"type": "input.dropdown"
},
"input_1gjNEk0A": {
"options": {
"items": [],
"token": "dependent",
"selectFirstSearchResult": true
},
"title": "Dependent Dropdown",
"type": "input.dropdown",
"dataSources": {
"primary": "ds_ouyeecdW"
}
},
"input_Ih820ou2": {
"options": {
"defaultValue": "-24h@h,now",
"token": "global_time"
},
"title": "Time Range Input Title",
"type": "input.timerange"
}
},
"layout": {
"type": "grid",
"structure": [],
"globalInputs": [
"input_Ih820ou2",
"input_ZIhOcc3q",
"input_1gjNEk0A"
]
},
"description": "",
"title": "Dependent Dropdown Example"
}
The OP is quite old. It is possible that there was a bug in 9.2.3 that caused selectFirstSearchResult to not take effect. I can confirm @tej57 's observation that the sample code behaves exactly as you asked in 9.4, too.
Mine did the same thing. It would seem it is your version of Splunk. Set up a test environment on a laptop or spare VM and run a newer version of Splunk and see if the problem remediates itself.
Hello @eriktb,
Did you try making DIRECT as a static and default value for the dependent dropdown. You can keep the makeresults section as it is to have different values populated based on the environment selection. However, if I understood the request properly, you need the DIRECT value selected by default for any of the environment. And, the case statement also ensures that for any of the environment value, DIRECT is one of the choice for the dependent dropdown.
Also, when I used your source code in my lab environment, it shows DIRECT as the selected value no matter what the environment dropdown selection is. Check the following screenshots for your reference:
I'm on Splunk v9.3.2. Let me know if you meant something else and we can think about it.
Thanks,
Tejas.